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Abstract 

A  renewed  interest  in  new  nuclear  power  generation  in  the  United  States  has  spurred  interest 
in  developing  advanced  reactors  with  features  which  will  address  the  public's  concerns  regarding 
nuclear  generation.  However,  it  is  economic  performance  which  will  dictate  whether  any  new 
orders  for  these  plants  will  materialize.  Economic  performance  is,  to  a  great  extent,  improved 
by  maximizing  the  time  that  the  plant  is  on-line  generating  electricity  relative  to  the  time  spent 
off-line  conducting  maintenance  and  refueling.  Indeed,  the  strategy  for  the  advanced  light  water 
reactor  plant  IRIS  (International  Reactor,  Innovative  &  Secure)  is  to  utilize  an  eight  year  operating 
cycle. 

This  thesis  has  developed  a  formalized  strategy  to  address,  during  the  design  phase,  the 
maintenance-related  barriers  to  an  extended  operating  cycle.  The  top-level  objective  of  this  thesis 
was  to  develop  a  methodology  for  injecting  component  and  system  maintainability  issues  into  the 
reactor  plant  design  process  to  overcome  these  barriers.  A  primary  goal  was  to  demonstrate  the 
applicability  and  utility  of  the  methodology  in  the  context  of  the  IRIS  design. 

The  first  step  in  meeting  the  top-level  objective  was  to  determine  the  types  of  operating  cy¬ 
cle  length  barriers  that  the  IRIS  design  team  is  likely  to  face.  Evaluation  of  previously  identified 
regulatory  and  investment  protection  surveillance  program  barriers  preventing  a  candidate  oper¬ 
ating  PWR  from  achieving  an  extended  (48  month)  cycle  was  conducted  in  the  context  of  the  IRIS 
design.  From  this  analysis,  54  known  IRIS  operating  cycle  length  barriers  were  identified.  The  res¬ 
olution  methodology  was  applied  to  each  of  these  barriers  to  generate  design  solution  alternatives 
for  consideration  in  the  IRIS  design. 

The  methodology  developed  has  been  demonstrated  to  narrow  the  design  space  to  feasible 
design  solutions  which  enable  a  desired  operating  cycle  length,  yet  is  general  enough  to  have 
broad  applicability.  Feedback  from  the  IRIS  design  team  indicates  that  the  proposed  solutions  to 
the  investigated  operating  cycle  length  barriers  are  both  feasible  and  consistent  with  sound  design 
practice. 
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Title:  Professor  of  Nuclear  Engineering 

Thesis  Reader:  Clifford  A.  Whitcomb 
Title:  Research  Scientist 
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Chapter  1 


Introduction 

1.1  Impetus 

The  deregulation  of  the  electric  power  industry  is  part  of  the  ongoing  national  trend  to  dereg¬ 
ulate  major  industries  such  as  the  airlines,  telecommunications,  and  natural  gas.  The  National 
Energy  Policy  Act  of  1992  allows  for  the  sale  of  electricity  on  the  open  market  and  for  customers 
to  choose  their  supplier.  Also,  Federal  Energy  Regulatory  Commission  (FERC)  Order  888,  "Pro¬ 
moting  Wholesale  Competition  Through  Open  Access  Non-discriminatory  Transmission  Services 
by  Public  Utilities,  Recovery  of  Stranded  Costs  by  Public  Utilities  and  Transmitting  Utilities,"  is¬ 
sued  in  1996,  requires  that  utility  and  non-utility  generators  have  open  access  to  the  electric  power 
transmission  system.  It  is  these  stranded  costs,^  or  more  specifically  the  need  to  avoid  them,  that 
has  motivated  the  nuclear  power  industry  to  develop  strategies  to  improve  its  economic  perfor¬ 
mance.  Only  by  pursuing  these  strategies  will  the  nuclear  industry  guarantee  its  short  term  sur¬ 
vival,  and  position  itself  for  long  term  growth  in  the  deregulated  environment. 

Conventionally  fueled  power  plants  start  with  an  immediate  economic  advantage  over  nu¬ 
clear  plants  because  of  lower  capital  costs.  Non-nuclear  power  plants  typically  have  a  shorter 
construction  schedule  and  lower  construction  costs,  allowing  the  investors  to  begin  recovering 
their  smaller  capital  investment  sooner.  Non-nuclear  power  plants  also  benefit  from  a  lack  of 
up  front  decommissioning  costs,  less  regulatory  costs,  and  (typically)  much  smaller  plant  staffing 

’stranded  costs  are  investments  or  assets  owned  by  regulated  electric  utilities  that  are  likely  to  become  inefficient  or 
uneconomic  in  a  competitive  marketplace. 


levels.  Nuclear  plants,  however,  have  a  clear  advantage  over  all  major  electric  power  produc¬ 
ing  competitors:  significantly  lower  fuel  costs.  But  a  nuclear  power  plant's  lower  fuel  costs  can 
only  offset  the  higher  capital  costs  if  the  amount  of  time  spent  on-line  producing  electricity  at  full 
capacity  significantly  exceeds  the  number  of  days  spent  shutdown. 

The  term  typically  used  to  measure  the  economic  performance  of  a  nuclear  power  plant  is 
unit  capability  factor.  Unit  capability  factor^  is  the  percentage  of  maximum  electricity  generation 
that  a  plant  is  capable  of  supplying  to  the  electrical  grid,  limited  only  by  factors  within  plant 
management's  control.  Since  U.S.  nuclear  power  plants  are  typically  operated  at  full  power,  the 
unit  capability  factor  is  directly  related  to  the  ratio  of  on-line  days  to  on-line  plus  off-line  days 
during  any  given  period.  Clearly,  then,  to  improve  the  unit  capability  factor  the  on-line  days  must 
increase,  the  off-line  days  must  decrease,  or  both.  This  can  be  accomplished  by  focusing  on  three 
general  areas: 

•  Increasing  the  cycle  length  between  refuelings, 

•  Minimizing  refueling  and  planned  maintenance  outage  times,  and 

•  Reducing  the  frequency  and  duration  of  forced  outages. 

It  should  be  noted  that  these  three  areas  are  not  independent.  Increasing  the  cycle  length  requires 
more  maintenance  to  either  be  conducted  on-line^  or  deferred  to  the  refueling  outage.  However 
deferring  maintenance  actions  increases  the  probability  of  a  component  failure  (which  might  have 
otherwise  been  detected  at  a  shorter  maintenance  interval)  causing  a  forced  outage. 

Currently  operating  pressurized  water  reactor  (PWR)  plants  are  aggressively  working  to  im¬ 
prove  their  economic  performance  by  optimizing  the  operating  cycle  length.  When  these  plants 
were  built  most  operated  on  fuel  cycles  as  short  as  12  months.  Today,  many  operate  on  an 
18  month  cycle  and  some  are  transitioning  to  fuel  cycles  as  long  as  24  months.  The  plant  mainte¬ 
nance  strategy  was  developed  to  support  the  initial  shorter  fuel  cycle  and  then  modified  to  support 
the  longer  cycle  lengths.  However,  these  plants  were  not  built  with  components  that  support  an 
extended  fuel  cycle  since  it  was  not  foreseen  that  the  nuclear  power  industry  would  struggle  to 

^As  defined  by  the  World  Association  of  Nuclear  Operators  (WANO)  and  the  Institute  of  Nuclear  Power  Operators 
(INPO). 

^On-Ime  performance  of  a  maintenance  or  testing  action  on  a  component  means  that  the  plant  is  still  at  power. 
The  component  may  be  on-service,  isolated  from  it's  system,  or  secured  during  this  period.  Off-line  performance  of  a 
maintenance  or  testing  action  on  a  component  means  that  the  plant  is  shutdown. 


remain  economically  competitive.  Regardless  of  advances  in  core  design,  which  have  been  sig¬ 
nificant,  the  unit  capabilty  factor  (and,  hence,  economic  competitiveness)  of  currently  operating 
PWR  plants  will  be  limited  by  the  performance  and  maintenance  requirements  of  the  installed 
equipment. 

A  rapid  increase  and  peak  of  conventional  fuel  costs  in  late  2000  and  into  early  2001  has  been 
a  significant  factor  in  the  renewal  of  interest  in  nuclear  generation.  Although  there  are  certified 
PWR  designs  available  (e.g.,  the  Westinghouse  AP600  and  System  80+  pressurized  water  reac¬ 
tors),  public  concerns  for  improved  passive  safety,  proliferation  resistance,  and  spent  fuel  disposal 
have  stimulated  new  advanced  reactor  plant  designs  which  address  these  issues.  One  strategy  to 
ensure  proliferation  resistance  and  potentially  reduce  the  amount  of  spent  fuel  generated  is  to  use 
a  fuel  cycle  much  longer  than  that  of  currently  operating  plants,  on  the  order  of  five  to  ten  years. 
Economically,  there  are  advantages  to  matching  the  maintenance  cycle  to  this  longer  fuel  cycle. 

1.2  The  Need  for  a  Design  Methodology 

Reactor  plant  designers  working  on  the  next  generation  of  nuclear  power  plants  must  work 
aggressively  to  eliminate  or  mitigate  the  limitations  of  the  currently  operating  (legacy)  plants. 
Clearly,  then,  maintainability  must  be  an  important  design  objective.  However,  there  is  currently 
no  methodology  for  integrating  component  and  system  maintainability  issues  into  the  reactor 
plant  design  process.  This  thesis  will  develop  such  a  methodology,  and  the  methodology  will 
be  applied  to  the  selection  and  design  of  components  whose  maintenace  requirements  have  been 
identified  as  potential  operating  cycle  length  barriers  for  an  advanced  light  water  reactor  plant. 

1.3  International  Reactor,  Innovative  &  Secure 

The  advanced  light  water  reactor  plant  to  which  this  design  methodology  will  be  applied  is 
the  International  Reactor,  Innovative  &  Secure  (IRIS).  IRIS  is  currently  being  developed  by  an  in¬ 
ternational  consortium,  led  by  Westinghouse  and  including  universities  (University  of  California 
at  Berkeley,  Massachusetts  Institute  of  Technology,  Polytechnic  of  Milan),  laboratories,  industry 
(Bechtel,  Mitsubishi  Heavy  Industries)  and  utilities  (Japan  Atomic  Power  Company,  Tennessee 
Valley  Authority).  The  nucleus  of  the  effort  was  provided  by  the  Department  of  Energy  (DOE) 
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Nuclear  Energy  Research  Initiative  (NERI)  program  which  funds  the  U.S.  participants.  The  orig¬ 
inal  NERI  program  has  attracted  international  interest  and  with  strong  impetus  from  Italy  and 
Japan  has  been  transformed  into  a  full-fledged  international  effort  to  develop  a  next  generation 
reactor.  The  main  characteristics  of  IRIS  are: 

•  Enhanced  safety  systems.  Utilization  of  a  single,  integrated,  self-pressurized  vessel  and  en¬ 
hanced  safety  systems  with  passive  safety  features  making  severe  accidents  leading  to  core 
damage  impossible.  The  integral  configuration  eliminates  the  possibility  of  loss  of  coolant 
accidents  of  significant  entity,  and  the  reactor  is  designed  for  a  very  high  level  of  natural 
circulation,  thus  eliminating  the  loss  of  flow  accident. 

•  Proliferation  resistance.  The  core  lifetime  is  projected  to  be  on  the  order  of  eight  years  with¬ 
out  fuel  shuffling  or  refueling.  Maintenance  of  the  nuclear  system  is  minimized  and  the  goal 
is  to  design  a  reactor  island  which  does  not  need  to  be  accessed  by  the  operator  over  the 
eight-year  core  lifetime.^ 

•  Simple  and  economical.  The  capital  cost  is  reduced  because  of  the  elimination  of  entire  sys¬ 
tems  such  as  refueling,  soluble  neutron  absorber,  and  emergency  core  cooling;  the  use  of  a 
single,  integrated,  self-pressurized  vessel;  and,  simplifications  throughout  the  plant,  e.g.  re¬ 
duction  in  piping  and  valves.  The  operations  and  maintenance  (O&M)  cost  is  substantially 
reduced  by  the  condition-based  maintenance  strategy,  no  partial  refuelings  (which  will  also 
increases  the  availability  factor),  and  the  use  of  modular,  easily  replaceable  components. 

•  Environmentally  friendly.  Because  of  the  very  long  life  of  the  core  the  amount  of  radioactive 
waste  spent  fuel  is  drastically  reduced  (of  the  order  of  five  times  less  than  current  reactors 
for  the  same  power  output).  A  possibility  which  will  be  considered  is  to  dispose  of  the  vessel 
'in  toto'  (i.e.,  without  removing  the  fuel)  which  would  provide  an  additional  barrier  to  the 
escape  of  radioactive  products. 

^In  late  2000,  partly  based  on  input  from  this  investigation,  the  IRIS  operating  strategy  was  changed  from  a  ten 
year  cycle  to  an  eight-year  cycle  with,  if  necessary,  a  maintenance  shutdown  at  the  midpoint  of  the  cycle.  This  strategy 
meets  the  NERI  proliferation  resistance  objective  of  no  operator  access  to  the  fuel  since  vessel  head  removal  will  only 
be  required  every  other  outage.  In  early  2001,  the  first  core  lifetime  was  changed  from  high  enrichment  to  low  (about 
5%)  enrichment  due  to  enrichment  facility  licensing  issues.  As  of  April  2001,  the  first  core  lifetime  is  projected  to  be  on 
the  order  of  five  years. 
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1.4  Goals  and  Objectives 


The  top-level  objective  of  this  thesis  is  to  develop  a  methodology  for  injecting  component  and 
system  maintainability  issues  into  the  reactor  plant  design  process.  However,  it  is  recognized 
that  the  design  process  must  consider  many  factors  other  than  just  maintainability.  Therefore,  the 
methodology  developed  must  not  simply  identify  the  "best"  design  alternative  based  on  maintain¬ 
ability  considerations  but  rather  must  qualitatively  rank  proposed  alternatives  based  on  overall 
maintainability.  Using  this  approach,  the  design  methodology  will  find  greater  utility  since  other 
factors  (such  as  cost)  may  have  a  higher  design  priority  but  knowledge  of  the  impact  of  these  other 
factors  on  maintainability  will  be  possible. 

The  methodology  is  intended  to  be  general  enough  to  have  broad  applicability,  yet  descriptive 
enough  to  ensure  that  all  relevant  maintainability  factors  are  considered.  It  carmot,  nor  is  it  in¬ 
tended  to,  replace  the  creative  element  in  design.  Rather,  the  methodology  is  intended  simply  to 
focus  the  creative  design  effort  on  those  factors  which  are  relevant  to  the  process.  Application  of 
the  methodology  will  be  illustrated  by  considering  several  barriers  identified  in  the  IRIS  concept 
design. 
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Chapter  2 


Design  Methodology  Framework 

2.1  Introduction 

The  design  methodology  which  this  thesis  seeks  to  develop  can  be  viewed  as  a  four-step  pro¬ 
cess,  shown  graphically  in  Figure  2-1.  The  first  step  is  the  synthesis  of  the  general  requirements 
that  the  component  must  satisfy,  which  is  a  non-trivial  task  based  on  both  experience  and  judge¬ 
ment.  The  second  step  is  the  synthesis  of  the  design  objectives  with  the  design  requirements. 
The  third  step  is  to  boimd  the  solution  space  by  application  of  suitable  and  relevant  constraints. 
The  final  step  is  to  develop  design  alternatives  which  meet  the  specifications  of  the  synthesized 
design  requirements,  objectives,  and  constraints.  This  chapter  presents  a  brief  description  of  the 
components  of  the  methodology.  Following  chapters  explore  the  inputs,  present  the  methodol¬ 
ogy  'engine'  in  detail,  and  demonstrate  application  of  the  methodology  to  several  identified  IRIS 
maintenance-related  barriers. 

2.2  Methodology  Inputs 

The  primary  inputs  to  the  methodology  'engine'  are  shown  graphically  in  Figure  2-1.  These 
inputs  are  intended  to  encompass  those  factors  most  relevent  to  component  and  system  design. 
Starting  from  Functional  Requirements  and  working  down  (see  Figure  2-1),  the  inputs  are  ordered 
such  that  each  successive  step  in  the  requirements  optimization  engine  serves  to  further  define  the 
solution  space  in  terms  of  all  previous  inputs.  The  exceptions  are  the  inputs  emerging  materials  and 
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Figure  2-1:  "Requirements  Optimization  Engine'  Concept 
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emerging  technologies,  which  broaden  the  solution  space  by  considering  future  capabilities  rather 
than  focusing  solely  on  current  capabilities. 

2.2.1  Functional  Requirements 

First  and  foremost,  the  functional  requirements  that  the  component  must  meet  need  to  be 
specified  in  the  most  explicit  terms  possible  without  introducing  bias  towards  current  solutions. 
If  the  functional  requirements  are  presented  in  broad  terms,  then  the  solution  space  will  be  un- 
managably  large.  If  specifications  are  introduced  based  on  currently  used  components  {i.e.,  're¬ 
lieve  pressure  with  zero  seat  leakage')  then  the  solution  space  is  artificially  narrowed  and  the 
solutions  which  emerge  will  be  biased  towards  the  current  component  (in  this  case,  a  valve). 

Early  in  the  design  process  these  functional  requirements  can  often  only  be  presented  broadly, 
and  so  the  solution  space  must  be  artificially  constrained  by  making  reasonable  assumptions  based 
on  engineering  judgement  and  experience.  As  an  example,  consider  the  general  functional  re¬ 
quirement  to  'prevent  reverse  flow'  in  an  arbitrary  flow  stream.  There  is  no  specification  of  the 
fluid,  fluid  conditions  (temperature,  pressure,  and  flowrate),  conditions  when  reverse  flow  must 
be  prevented,  or  upstream  and  downstream  components.  However,  reasonable  assumptions  can 
be  made  as  to  the  conditions  tmder  which  this  requirement  must  be  met  to  further  specify  the  func¬ 
tional  requirement  and  bound  the  solution  space.  In  the  main  feedwater  supply  line,  for  example, 
this  requirement  can  be  further  specified  as 

•  'prevent  reverse  flow  of  high  temperature  and  pressure  water  or  water/steam  mixture  from 
the  steam  generator  when  the  feedwater  supply  line  pressure  is  less  than  steam  generator 
pressure, 

•  allow  forward  flow  of  low  temperature,  high  pressure  water  with  minimum  resistance,  and 

•  perform  functional  requirement  automatically  and  without  an  external  energy  input.' 

Our  design  paradigms  lead  us  immediately  to  a  swing-type  check  valve  as  a  design  solution  to 
these  requirements.  However,  these  requirements  could  also  be  met  by  either  of  the  arrangements 
shown  in  Figure  2-2.  By  not  artificially  over-constraining  the  design  space,  innovative  solutions 
meeting  the  functional  requirements  can  be  generated. 
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Figure  2-2:  Conceptual  reverse  flow  preventers  meeting  functional  requirements.  Hydraulically 
operated  gate  valve  (top)  uses  differential  pressure  between  the  main  feedwater  pump  discharge 
and  steam  generator  inlet  to  move  the  piston.  The  valve  on  the  bottom  uses  a  ball  which  is  moved 
by  form  drag  caused  by  the  flowing  fluid.  For  both  cases,  forward  flow  is  from  left  to  right. 


2.2.2  Regulatory  Requirements 

The  purpose  of  regulatory  requirements  is  to  ensure  the  health  and  safety  of  the  general  public. 
The  scope  and  periodicity  of  any  regulation  should  be  traceable  back  to  it's  role  in  ensuring  public 
health  and  safety.  For  any  design  decision  made,  the  potential  impact  of  that  decision  on  public 
health  and  safety  must  be  assessed  so  that  the  regulatory  impact  can  be  estimated. 

For  the  purposes  of  this  thesis  investigation,  it  is  helpful  to  view  regulatory  requirements  as 
being  of  two  categories:  those  that  currently  exist  and  those  that  are  likely  to  be  generated  as  a 
result  of  design  decisions  which  depart  from  current  practice.  It  would  be  naive  to  assume  that  a 
creative  design  solution  which  satisfies  the  wording  of  a  particular  regulation  will  automatically 
satisfy  the  intent  of  the  regulation.  Most  regulations  are  not  developed  proactively  but  rather 
reactively  in  response  to  a  proposed  design  configuration  or,  in  some  cases,  public  perception  of 
the  risk  associated  with  the  proposed  design. 

The  Nuclear  Regulatory  Commission  (NRC)  has  embarked  on  a  wide  range  of  efforts  to  in¬ 
crease  the  effectiveness  with  which  it  regulates  the  nuclear  industry.  Key  to  these  improvements 
are  three  specific  initiatives:  the  Regulatory  Excellence  initiative;  the  overall  movement  toward 
a  regulatory  approach  that  is  risk-informed  and,  where  appropriate,  performance-based;  and  the 
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cost-beneficial  licensing  program.^  Strategies  to  make  the  entire  NRC  regulatory  framework  more 
risk-informed  (i.e.,  such  that  areas  of  highest  risk  receive  the  greatest  focus)  and,  where  appro¬ 
priate,  more  performance-based  (i.e.,  more  results-oriented  and  more  open  to  allowing  licensee 
flexibility  in  how  to  meet  NRC  regulatory  requirements)  are  being  developed. 

The  NRC  staff  has  developed  generic  regulatory  guidance,  in  the  form  of  regulatory  guides 
and  standard  review  plans,  as  well  as  on  the  use  of  probabilistic  risk  assessment  (PRA)  findings 
and  insights  in  support  of  licensee  requests  for  changes  to  their  licensing  requirements.  Pilot  ap¬ 
plications  have  approved  graded  quality  assurance  requirements  and  increased  allowed  outage 
times  for  equipment  in  Technical  Specifications.^  Out  of  these  pilots,  application-specific  regula¬ 
tory  guides  and  standard  review  plans  are  being  developed  and  are  under  review  by  the  Advisory 
Committee  on  Reactor  Safeguards  (ACRS). 

The  NRC  cost  beneficial  licensing  action  program  was  established  in  1994  to  increase  agency 
responsiveness  to  licensee  requests  for  reduction  or  elimination  of  license  requirements  with  small 
effects  on  safety  but  high  economic  burden.  Although  activity  and  involvement  in  this  volimtary 
program  has  varied  among  licensees,  the  NRC  staff  has  approved  over  300  cost  beneficial  licens¬ 
ing  actions.  The  licensees  estimate  that  the  savings  resulting  from  these  cost  beneficial  licensing 
actions  exceed  $799  million  over  the  life  of  the  facilities. 

The  cumulative  effect  of  these  NRC  initiatives  is  to  create  a  regulatory  environment  where  the 
regulatory  intent  is  being  clarified  and  adherence  to  the  intent  of  the  regulations  is  being  empha¬ 
sized.  Rather  than  dictate  to  the  licensee  how  to  meet  the  regulatory  requirements,  the  NRC  is 
shifting  the  burden  to  the  licensee  to  determine  (and  demonstrate)  the  most  appropriate  method 
of  ensuring  that  the  regulatory  intent  is  met.  This  change  creates  design  flexibility,  since  signif¬ 
icant  departures  from  current  design  practice  (such  as  is  the  case  for  IRIS)  need  only  to  demon¬ 
strate  to  the  NRC  what  the  safety  role  of  the  system/ component  is,  the  risk  significance  of  the 
system/component,  and  what  method(s)  will  be  used  to  ensure  that  the  system/component  can 
perform  the  specified  functions  when  required. 

’statement  submitted  by  the  United  States  Nuclear  Regulatory  Commission  to  the  Subcommittee  on  Energy  and 
Power,  Committee  on  Commerce,  United  States  House  of  Representatives  by  Shirley  Ann  Jackson,  Chairman,  USNRC, 
March  25, 1998 

^Technical  Specifications  are  part  of  an  NRC  license  authorizing  the  operation  of  a  nuclear  production  or  utiliza¬ 
tion  facility  A  Technical  Specification  establishes  requirements  for  items  such  as  safety  limits,  limiting  safety  system 
settings,  limiting  control  settings,  limiting  conditions  for  operation,  surveillance  requirements,  design  features,  and 
administrative  controls. 
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2.2.3  Investment  Protection  Requirements 

Some  components  and  systems  such  as  the  main  turbine  generator  represent  a  significant 
capital  investment  by  the  owner/ operator,  and  catastrosphic  failure  (and  associated  replacement 
costs)  cannot  be  tolerated  in  a  deregulated,  economically  competitive  market.  To  ensure  operabil¬ 
ity  of  these  components  the  utility  performs  surveillances,^  even  if  not  required  by  regulation. 
The  scope  and  frequency  of  these  surveillances  are  determined  by  trading  off  the  risk  (and  cost) 
of  failure  and  subsequent  downtime  against  the  cost  of  performing  the  surveillances. 

A  subset  of  these  investment  protection  requirements  are  surveillances  performed  to  maintain 
the  revenue  stream.  They  typically  are  related  to  components  that,  if  performance  is  degraded, 
directly  impact  the  amoimt  of  electrical  power  generated.  An  example  is  the  main  condenser  wa- 
terbox.  Fouling  of  the  condenser  tubes  by  micro-organisms  and  other  organic  matter  in  the  cooling 
water  can  significantly  degrade  the  condenser  heat  transfer  capability,  reducing  thermodynamic 
cycle  efficiency.  If  the  main  condenser  heat  transfer  capability  is  degraded,  either  the  plant  must 
be  operated  at  reduced  load  or  operate  at  full  load  and  risk  overheating  and  potentially  severe 
damage  to  the  condenser  (including  overpressurization  and  rupture).  It  is  therefore  in  the  eco¬ 
nomic  interest  of  the  utility  to  conduct  periodic  main  condenser  waterbox  cleaning,  and  waterbox 
cleaning  is  currently  performed  at  18-24  month  intervals  (coincident  with  a  refueling  outage). 

2.2.4  Economical  Solution 

An  owner/ operator  operates  for  the  sole  purpose  of  generating  revenue.  It  typically  has  no 
particular  preference  as  to  how  the  electricity  is  generated  (coal,  natural  gas,  or  nuclear)  as  long 
as  the  plant  meets  environmental  regulations  and  is  economically  competitive  in  the  long-term 
market.  As  stated  earlier,  non-nuclear  plants  have  significantly  lower  capital  costs  but  nuclear 
plants  incur  significantly  lower  fuel  costs.  Therefore,  to  make  a  nuclear  plant  attractive  to  potential 
investors  the  capital  costs  must  be  reduced. 

All  design  decisions  have  an  impact,  either  directly  or  indirectly,  on  both  capital  and  operat¬ 
ing  costs.  However,  potential  investors  are  concerned  about  both  the  time  to  recoup  the  initial 
investment  (which  is  directly  linked  to  the  capital  costs)  and  the  long-term  profitability  (which  is 

^The  term  'surveillance'  defines  a  variety  of  component  tests,  inspections,  overhauls,  and  preventive  maintenance 
actions. 
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directly  linked  to  the  operating  costs).  Necessarily,  then,  these  design  decisions  must  consider  the 
impact  on  both  capital  and  operating  costs  together  to  find  an  optimal  point. 

2.2.5  Operating  Cycle  Objectives 

To  place  the  functional  requirements  in  context,  an  operating  (or  maintenance)  cycle  length 
must  be  specified.  To  meet  the  specified  cycle  length  objective,  the  component  must  either  require 
no  maintenance  for  the  entire  cycle  or  be  maintainable  during  the  cycle.  From  a  practical  stand¬ 
point,  many  components  (or  the  systems  in  which  they  operate)  can  often  be  secured  for  short 
periods  for  the  performance  of  maintenance.  However,  some  components  are  necessary  for  con¬ 
tinuous  plant  operation  or  to  ensure  safety.  These  components  cannot  be  secured  unless  their  vital 
functions  can  be  performed  by  another  component  or  system. 

The  operating  cycle  length  goal  for  IRIS  is  eight  years.  It  is  not  an  objective  to  eliminate  all 
maintenance  between  IRIS  maintenance  outages,  but  rather  to  perform  all  surveillances  which 
have  a  periodicity  of  less  than  eight  years  on-line.  However,  to  ensure  proliferation  resistance  no 
operator  access  to  the  reactor  island^  is  permitted  between  refueling  outages. 

As  a  strategy  to  achieve  the  eight  year  maintenance  cycle  length  objective  IRIS  will  first  look 
to  design  solutions  which  permit  on-line  maintenance  using  current  techniques  and  then,  if  a 
suitable  design  solution  carmot  be  found,  to  development  of  techniques  which  will  permit  on-line 
maintenance  of  the  current  component.  The  benefit  in  seeking  design  solutions  first  is  two-fold: 
the  design  will  be  to  current  standards  and  thus  less  susceptible  to  regulatory  challenge,  and 
the  cost  of  development  of  new  maintenance  monitoring  and  performance  evaluation  techniques 
(including  costs  associated  with  potentially  required  regulatory  changes)  is  avoided. 

2.2.6  Component  Maintenance  History 

In  general,  the  further  a  design  departs  from  current  practice  the  greater  the  risk  in  terms  of 
both  cost  and  performance.  It  is  prudent,  therefore,  to  evaluate  the  component  which  is  currently 
used  to  meet  the  specified  functional  requirements  to  assess  it's  deficiencies.  A  minimal  risk  solu¬ 
tion  might  be  found  which  involves  only  a  minor  modification  to  the  currently  used  component. 

‘^Specifically,  no  fuel  access  is  permitted  by  preventing  access  to  the  reactor  vessel  internals  during  non-refueling 
outages. 
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A  thorough  evaluation  of  the  currently  used  component  may  also  discover  component  unde¬ 
sirable  attributes  which  cannot  be  removed  simply  by  minor  component  modification.  Identifi¬ 
cation  of  these  components,  and  the  particular  attributes  requiring  redesign,  is  a  critical  step  in 
narrowing  the  number  of  components  needing  redesign  to  a  managable  size.  In  his  1996  thesis, 
Moore^  presented  a  strategy  for  a  four  year  operating  cycle  at  a  commercial  PWR  plant.  He  con¬ 
cluded  that  to  achieve  a  four  year  cycle  at  the  plant  being  investigated  significant  modifications 
would  be  required,  due  in  major  part  to  a  limited  number  of  surveillances  which  could  not  be 
resolved  to  a  four  year  operating  cycle. 

2.2.7  Commercial  Manufacturing  Capability 

Implied  in  any  design  is  the  ability  to  manufacture  the  various  components  contained  in  the 
design.  It  is  reasonable  to  assume  that  a  currently  manufactured  component  can  be  manufactured 
with  minor  modifications  at  roughly  the  same  cost  and  on  a  similar  manufacturing  schedule.  New 
components,  on  the  other  hand,  require  new  machine  tooling  which  adds  significantly  to  the  com¬ 
ponent  acquisition  cost  and  manufacturing  timeline.  Additionally,  new  components  require  test¬ 
ing  and  evaluation  at  much  greater  detail  than  modified  components  which  also  adds  to  the  cost 
and  procurement  time. 

2.2.8  Emerging  Technologies 

As  owner/ operators  work  toward  a  deregulated  competitive  marketplace,  much  effort  has 
been  expended  examining  the  basis  of  current  maintenance  and  operating  practices.  One  area 
receiving  considerable  attention  is  reduction  of  outage  duration  by  conducting  maintenance  on¬ 
line.  The  byproduct  of  this  attention  is  research  and  development  of  advanced  technologies  which 
become  on-line  maintenance  enablers. 

The  focus  in  applying  these  technologies  is  on  currently  installed  components,  since  extensive 
back-fits  to  install  new  components  which  utilize  these  new  technologies  are  generally  not  cost 
effective.  But,  as  a  result  of  these  development  efforts,  undeveloped  technologies  may  exist  which 

^Moore  Jr.,  Thomas  Joseph,  "A  Surveillance  Strategy  for  a  Four  Year  Operating  Cycle  in  Commercial  Pressurized 
Water  Reactors/'  Massachusetts  Institute  of  Technology  Department  of  Nuclear  Engineering,  Nuclear  Engineer's  The¬ 
sis,  May  1996. 
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would  be  beneficial  to  a  modified  component  but  were  not  pursued  further  since  they  were  not 
relevent  to  any  currently  installed  components. 

2.2.9  Emerging  Materials 

For  certain  component  attributes  which  contribute  to  shortened  life,  such  as  corrosion  resis¬ 
tance  and  susceptibility  to  embrittlement,  new  materials  may  provide  solutions  where  the  origi¬ 
nal  component  is  retained  but  fabricated  from  a  'better'  material.  New  materials  may  allow  the 
component  to  operate  in  an  environment  that  the  original  material  could  not,  saving  considerable 
design  effort  and  simplifying  the  integration  of  the  component  into  the  overall  design.  New  ma¬ 
terials,  however,  may  not  necessarily  lead  to  cost  savings  since  they  may  need  to  be  proven  in  the 
anticipated  operating  environment. 

2.3  Methodology 

The  simplified  design  resolution  methodology  is  shown  in  Figure  2-3.  The  resolution  method¬ 
ology  iteratively  evaluates  the  current  state  of  the  design  against  the  specified  requirements  until 
all  the  requirements  have  been  met  through  component  modification  or  redesign. 

The  resolution  process  begins  with  the  fuctional  requirement  to  be  satisfied  and  the  component 
currently  used  to  satisfy  that  requirement.  Successive  iterations  evaluate  the  design  against  the 
next  performance  requirement  in  an  external  process  until  all  requirements  have  been  satisfied. 
If  the  current  state  of  the  design  does  not  meet  a  particular  requirement,  then  the  design  is  either 
modified  (if  possible)  or  a  new  design  is  generated  (if  necessary)  by  external  processes.^  These 
external  processes,  described  in  detail  in  Chapter  5,  draw  upon  the  judgement  and  experience  of 
the  engineer  to  move  past  current  design  paradigms  and  apply  creativity  to  overcome  the  imposed 
barrier. 

*Used  in  this  thesis,  external  processes  are  those  creative  design  processes  which  cannot  be  formally  structured 
within  the  resolution  methodology. 
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2.4  Output 

2.4.1  Evolutionary  and  Revolutionary  Design  Solutions 

When  a  limitation  is  identified  in  a  component  or  system,  or  an  increase  in  performance  above 
current  capabilities  is  required,  design  changes  are  required.  The  designer  can  either  improve  the 
current  component  by  modifying  the  component  {evolutionary  design)  or  by  finding  a  completely 
different  method  to  meet  the  design  requirements  {revolutionary  design).  In  practice,  all  design 
processes  involve  a  combination  of  the  two.  The  designer  must  always  evaluate  whether  a  revo¬ 
lutionary  design  would  better  accomplish  the  prescribed  function  than  an  evolutionary  design  in 
order  to  ensure  that  the  most  cost-effective  and  best  engineered  solution  is  obtained. 

Necessarily,  IRIS  will  include  both  evolutionary  and  revolutionary  design  solutions.  A  truly 
revolutionary  design  is  inherently  unproven,  and  the  economic  risk  is  likely  to  be  unacceptable. 
A  truly  evolutionary  design  is  unlikely  to  significanly  improve  the  performance  (including  main¬ 
tainability)  of  current  PWR  designs,  and  therefore  may  not  be  economically  desirable.  The  implicit 
goal  for  IRIS,  then,  is  to  utilize  revolutionary  design  solutions  where  necessary  and  evolutionary 
design  solutions  where  practical. 

2.4.2  Design  Alternatives 

The  output  from  the  methodology  consists  of  a  set  of  design  alternatives,  all  of  which  meet  the 
specified  requirements,  ranked  by  maintainability.  The  methodology  will  only  be  a  useful  tool  for 
design  optimization  if  the  maintainability  optimization  has  already  been  conducted. 
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Chapter  3 


Operating  Pressurized  Water  Reactor 
Surveillance  Program 

3.1  Introduction 

This  chapter  describes  the  cycle  length  barriers  existing  in  a  currently  operating  pressurized 
water  reactor.  The  data  utilized  in  this  chapter  is  obtained  from  a  recent  thesis  investigation  into 
extending  a  candidate  currently  operating  PWR  from  an  18  month  to  a  48  month  operating  cycle. 
The  data  has  been  reexamined,  in  the  context  of  this  thesis,  to  determine  the  types  of  maintenance 
related  barriers  for  which  a  design  solution  must  be  found. 

After  presenting  the  barriers  to  the  candidate  PWR  48  month  operating  cycle,  the  implications 
of  the  candidate  PWR  cycle  length  barriers  on  the  IRIS  cycle  length  are  discussed.  This  chapter 
concludes  by  describing  where  design  effort  should  be  focused  to  resolve  the  cycle  length  barriers 
which  will  likely  exist  in  an  IRIS  maintenance  program. 

3.2  Basis  for  Operating  Pressurized  Water  Reactor  Surveillances 

Surveillances  are  performed  either  because  they  are  required  to  ensure  safety  or  because  they 
are  prudent  to  protect  capital  investment.  All  surveillances,  then,  can  be  categorized  into  the 
following  two  broad  categories: 

•  Regulatory  Based:  surveillances  performed  to  meet  technical  specification  requirements.  In 
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general,  the  scope  of  the  surveillance  and  the  performance  interval  are  specified  by  regula¬ 
tory  authority. 

•  Investment  Protection:  non-technical-specification-based  surveillances,  including  surveil¬ 
lances  performed  as  a  result  of  committments  to  agencies  other  than  the  NRC.  In  general  the 
scope,  performance  mode,  and  periodicity  are  selected  at  the  discretion  of  the  owner /operator 
to  protect  those  systems  and  components  with  significant  investment  costs. 

The  investment  protection  surveillances  can  be  further  broken  down  into  the  reactor  and  sup¬ 
porting  components  and  systems,  referred  to  as  the  nuclear  steam  supply  system  (NSSS),  and  all 
others,  referred  to  as  balance  of  plant  (BOP).  Since  the  safety  function  is  primarily  associated  with 
the  NSSS,  most  regulatory  based  surveillances  apply  to  NSSS  components  and  systems. 

3.3  A  48  Month  Operating  Pressurized  Water  Reactor  Surveillance  Pro¬ 
gram 

In  1996,  Thomas  Moore  developed  a  surveillance  strategy  for  a  48  month  operating  cycle  in  a 
commercial  PWR.^  Moore's  investigation  was  part  of  the  Massachusetts  Institute  of  Technology 
(MIT)  Extended  Fuel  Cycle  Project  which,  under  the  auspice  of  the  MIT  Program  for  Advanced 
Nuclear  Power  Studies,  investigated  surveillance  strategies  for  extending  commercial  pressurized 
water  and  boiling  water  nuclear  reactor  plant  operating  cycles  to  48  months.^  Moore  analyzed  the 
existing  surveillance  program  at  a  candidate  PWR  plant  to  assess  the  impact  of  an  operating  cycle 
change  from  18  months  to  48  months.  After  appropriate  justification,  surveillances  were  placed 
in  one  of  three  categories:  candidates  for  on-line  performance  (Category  A);  candidates  for  off¬ 
line  performance  interval  extension  to  48  months  (Category  B);  and  barriers  to  a  48  month  cycle 
(Category  C). 

The  3108  surveillances  considered  at  the  candidate  PWR  were  categorized  as  following: 

'Moore  Jr.,  Thomas  Joseph,  "A  Surveillance  Strategy  for  a  Four  Year  Operating  Cycle  in  Commercial  Pressurized 
Water  Reactors,”  Massachusetts  Institute  of  Technology  Department  of  Nuclear  Engineering,  Nuclear  Engineer's  The¬ 
sis,  May  1996. 

^McHenry,  R.S.,  T.J.  Moore,  J.H.  Maurer,  and  N.E.  Todreas,  "Surveillance  Strategy  for  an  Extended  Operating  Cycle 
in  Commercial  Nuclear  Reactors,"  The  Fifth  International  Topical  Meeting  on  Nuclear  Thermal  Hydraulics,  Operations, 
and  Safety  (NUTHOS-5),  April  14-18, 1997,  Beijing,  China. 
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•  2673  in  Category  A  (on-line),  of  which  67  require  a  reduced  power  condition, 

•  381  in  Category  B  (extended  to  48  months),  and 

•  54  in  Category  C  (incompatible  with  a  48  month  cycle). 

A  breakdown  of  the  candidate  PWR  surveillances  is  shown  in  Table  3.1.^ 

It  should  be  noted  that  690  electrical  related  investment  protection  surveillances  were  not  ex¬ 
plicitly  analyzed,  but  were  considered  conducive  to  on-line  performance  and  are  included  in  the 
Category  A  total. 

It  should  also  be  noted  that  many  of  the  381  Category  B  surveillances  could  have  been  placed  in 
Category  A  rather  than  extending  the  surveillance  periodicity.  However,  the  goal  of  Moore's  effort 
was  to  develop  a  balanced  surveillance  strategy  and  not  simply  to  maximize  on-line  surveillance 
performance.  For  IRIS,  maximizing  the  on-line  surveillance  performance  will  be  a  key  enabler 
for  the  eight  year  operating  cycle  length  objective. 

3.4  Extending  the  48  Month  Surveillance  Program  to  Eight  Years 

Although  the  MIT  Extended  Fuel  Cycle  Project  team  developed  a  four-year  surveillance  strat¬ 
egy,  there  has  been  no  industry  effort  to  achieve  such  an  operating  cycle  length.  A  practical  ap¬ 
plication  of  the  proposed  four-year  surveillance  strategy  would  have  provided  both  validation  of 
the  methodology  and  historical  data  on  the  effectiveness  of  the  methodology.  In  the  absence  of 
such  data,  resolving  all  surveillances  at  the  operating  PWR  with  respect  to  the  baseline  four  year 
(or  goal  eight  year)  IRIS  cycle  length  would  require  examination  of  each  of  the  several  thousand 
surveillances.  It  is  not  the  intent  of  this  thesis  to  resolve  all  the  cycle  length  barriers,  but  rather  to 
develop  a  methodology  which  will  assist  the  reactor  plant  designer  in  designing  systems  which 
are  not  cycle  length  limiting. 

Therefore,  this  analysis  will  begin  with  the  results  of  Moore's  investigation  into  a  48  month  op¬ 
erating  cycle.  Moore's  investigation  identified  the  barriers  to  extending  the  operating  PWR  from 
18  months  to  48  months,  and  provided  a  methodology  for  developing  the  technical  justification 

^Moore  Jr.,  Thomas  Joseph,  "A  Surveillance  Strategy  for  a  Four  Year  Operating  Cycle  in  Commercial  Pressurized 
Water  Reactors,"  Massachusetts  Institute  of  Technology  Department  of  Nuclear  Engineering,  Nuclear  Engineer's  The¬ 
sis,  May  1996,  Tables  3-12  and  3-39. 
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Table  3.1:  Recommended  Pressurized  Water  Reactor  48  Month  Operating  Cycle  Surveillance 
Program® 


Technical 

Surveillances 

Specification  .  V  ■ 

Cat  A 

CatB 

Gate 

Regulatory  Based  Surveillances: 

In-Service  Testing 

229 

147 

67 

15 

Reactivity  Control 

17 

13 

4 

0 

Power  Distribution  Limits 

17 

17 

0 

0 

Instrumentation 

436 

390 

44 

2 

Reactor  Coolant 

18 

13 

4 

1 

Emergency  Core  Cooling  System 

16 

9 

5 

2 

Containment 

81 

61 

20 

0 

Plant  Systems 

51 

51 

0 

0 

Electrical  Systems 

846 

824 

22 

0 

Technical  Requirements 

61 

61 

0 

0 

Subtotal 

1772 

1586 

571 

20 

NSSS“  Investment  Protection  Surveillances: 

Component  Cooling 

21 

8 

4 

9 

Rod  Control 

22 

6 

16 

0 

Chemical  Volume  and  Control 

7 

3 

3 

1 

Nuclear  Instruments 

4 

0 

4 

0 

Reactor  Coolant 

84 

39 

37 

8 

Residual  Heat  Removal /Safety  Injection 

4 

0 

4 

0 

Miscellaneous  NSSS 

84 

44 

40 

0 

Subtotal 

226 

100 

108 

18 

BOP^  Investment  Protection  Surveillances: 

Auxiliary  Systems 

83 

35 

41 

7 

Condensate 

17 

14 

0 

3 

Circulating  Water/Service  Water 

19 

14 

5 

0 

Diesel  Generator 

28 

26 

2 

0 

Main  Steam 

39 

21 

12 

6 

Feedwater 

60 

45 

15 

0 

Turbine  Systems 

72 

49 

23 

0 

Miscellaneous  BOP 

102 

93 

9 

0 

Subtotal 

420 

297 

W 

16 

'■Total 

31Q8T 

2673‘='i 

381 

54'?^ 

‘^Nuclear  Steam  Supply  System 
^Balance  of  Plant 

‘^Includes  690  electrical  systems  investment  protection  surveillances  which,  although  not  analyzed,  are  considered 
likely  candidates  for  on-line  performance 
^^67  at  reduced  power 


for  performance  interval  extension.  After  application  of  the  methodology,  54  off-line  surveillances 
were  identified  that  would  not  be  compatible  with  a  48  month  operating  cycle.  An  additional 
381  off-line  surveillances  were  either  already  compatible  with  the  48  month  operating  cycle  or 
could  have  their  performance  interval  extended,  based  on  the  performance  interval  extension 
methodology,  to  48  months. 

Because  of  his  objectives,  Moore's  investigation  did  not  consider  either  shutdown  surveil¬ 
lances^  or  off-line  surveillances^  with  a  performance  interval  already  compatible  with  a  48  month 
operating  cycle.  There  are  shutdown  surveillances  which  cannot  have  their  performance  interval 
extended  to  eight  years  even  though  they  are  only  required  to  be  performed  during  an  outage. 
An  example  is  shutdown  rod  testing,  which  is  required  each  outage  in  which  reactor  vessel  head 
removal  occurs.  Although  no  performance  interval  is  specified,  it  is  unlikely  that  an  eight  year 
rod  testing  performance  interval  (i.e.,  the  IRIS  refueling  interval)  will  be  frequent  enough  to  val¬ 
idate  the  reactor  protection  system  assumptions  regarding  rod  control  system  performance  (e.g., 
position  indication,  rod  speed,  and  rod  motion  without  binding).  Of  greater  potential  impact  are 
the  off-line  surveillances  which  were  already  compatible  with  a  48  month  operating  cycle  (and 
neither  identified  nor  investigated  by  Moore),  but  are  unlikely  to  be  compatible  with  an  eight  year 
operating  cycle. 

Assessment  of  the  operating  PWR  surveillance  program  relative  to  the  IRIS  eight-year  operat¬ 
ing  cycle  length  objective  requires,  in  part,  resolution  of  the  435  surveillances  (54  Category  C  and 
381  Category  B)  identified  by  Moore.  It  must  be  recognized  that  the  technical  justification  Moore 
provided  to  extend  the  Category  B  surveillances  to  48  months  may  not  necessarily  apply  to  an  in¬ 
terval  extension  to  eight  years,  resulting  in  IRIS  cycle  length  barriers.^  However,  development  of 
a  methodology  which  will  resolve  the  identified  Category  C  barriers  will  likely  provide  a  solution 
to  the  unidentified  Category  B  barriers  as  well. 

^Shutdown  surveillances  are  those  surveillances  which  are  performed  in  conjunction  with  a  planned  outage,  usually 
on  components  and  systems  which  support  the  outage.  These  surveillances  are  not  required  to  be  performed  when  the 
reactor  plant  is  at  power. 

^Off-line  surveillances  are  surveillances  on  components  and  systems  which  support  power  operation,  but  cannot  be 
performed  at  power. 

^As  stated  in  Section  1.3,  the  IRIS  operating  cycle  objective  is  eight  years.  The  BNFL  economic  model  indicates  that 
IRIS  is  still  economically  competitive  with  a  maintenance  outage  at  mid-cycle,  but  an  eight-year  maintenance  cycle  is 
preferred.  The  economic  model  also  indicates  that  with  more  than  one  maintenance  outage  per  eight-year  refueling 
cycle,  IRIS  economic  competitiveness  drops  considerably. 


3.5  Potential  IRIS  Cycle  Length  Barriers 


The  following  discussion  describes  the  operating  PWR  Class  C  maintenance-related  barriers 
which  are  potential  barriers  to  the  eight-year  IRIS  operating  cycle  length.  This  section  only  identi¬ 
fies  the  limitations  of  current  PWRs  if  the  operating  cycle  were  extended  to  eight  years,  regardless 
of  whether  or  not  those  components  and  systems  would  be  utilized  in  IRIS.  Although  Table  3.1 
breaks  down  the  surveillances  by  system,  the  discussion  here  will  focus  on  the  general  limita¬ 
tions  by  component  type.  As  noted  in  Section  3.4  above,  some  Category  B  surveillances  could 
also  be  limiting  for  an  operating  cycle  length  greater  than  48  months.  However,  the  Category  C 
surveillances  are  representative  of  the  maintenance-related  barriers  existing  in  the  operating  PWR 
surveillance  program  and  a  methodology  to  resolve  the  Category  C  surveillances  should  also  lead 
to  resolution  of  the  Category  B  surveillances  as  well. 

3.5.1  Regulatory  Based  Surveillances 

Regulatory  based  surveillances  are  those  surveillances  performed  to  meet  technical  specifica¬ 
tion  requirements.  Administrative  Technical  Specifications  and  Refueling  Technical  Specifications 
were  not  included  in  the  original  analysis,  and  are  not  included  here,  since  their  specific  require¬ 
ments  are  independent  of  cycle  length. 

3.5.1.1  Relief  Valves 

At  the  candidate  PWR,  there  are  several  regulatory  based  relief  valve  surveillances  which 
are  currently  performed  shutdown.  The  relief  valves  to  which  these  surveillances  apply  can¬ 
not  be  tested  on-line  and,  because  of  their  performance  history,  testing  cannot  be  extended  to 
eight  years.  At  the  candidate  PWR  these  38  valves  include  the  three  American  Society  of  Me¬ 
chanical  Engineers  (ASME)  Class  1  pressurizer  relief  valves  and  35  ASME  Class  2  containment 
pressure  boundary  relief  valves.^  Extrapolating  the  candidate  PWR's  valve  performance  history, 
and  based  on  consistent  but  limited  survey  results,  it  appears  likely  that  no  relief  valve  used  in 

^Generally,  ASME  Code  Class  1  includes  all  reactor  pressure  boundary  components.  ASME  Code  Class  2  gener¬ 
ally  includes  systems  or  portions  of  systems  important  to  safety  that  are  designed  for  post-accident  containment  and 
removal  of  heat  and  fission  products.  ASME  Code  Class  3  generally  includes  those  system  components  or  portions 
of  systems  important  to  safety  that  are  designed  to  provide  cooling  water  and  auxiliary  feedwater  for  the  front-line 
systems. 
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these  applications  (regardless  of  specific  type  or  brand)  has  a  performance  history  which  supports 
an  eight  year  testing  interval. 

The  Operations  and  Maintenance  of  Nuclear  Power  Plants,  ASME/ANSI,  OM-1989,®  Chap¬ 
ter  1,  lists  the  requirements  for  in-service  performance  testing  of  nuclear  power  plant  pressure 
relief  devices.  It  requires  all  ASME  Class  1  relief  valves  to  be  tested  every  five  years  and  that 
at  least  25%  of  each  type  of  Class  1  valve  be  tested  every  24  months,  50%  every  36  months,  75% 
every  48  months,  and  every  relief  valve  be  tested  at  least  once  every  60  months.  Plants  have  the 
option  of  testing  the  relief  valves  in  place  or  replacing  the  relief  valve  with  a  bench  tested  spare. 
Relief  valves  which  are  replaced  by  bench  tested  spares  are  also  required  to  be  bench  tested  after 
removal  to  determine  if  a  removed  valve  exceeds  the  ±3%  set  pressure  criteria.  For  those  relief 
valves  failing  to  meet  set  pressure  criteria,  the  causal  effect  must  be  evaluated  to  determine  the 
need  for  additional  testing.  The  candidate  PWR  conducts  Class  1  relief  valve  testing  at  a  shorter 
interval,  coincident  with  refueling  outages. 

The  Class  2  relief  valves  can  also  either  be  tested  in  place  or  replaced  by  a  bench  tested  spare. 
Unlike  Class  1  relief  valves.  Class  2  relief  valves  are  only  required  to  be  tested  every  ten  years 
with  at  least  25%  of  each  type  tested  every  48  months.  However,  the  performance  of  the  candidate 
PWR's  Class  2  relief  valves  has  not  proven  historically  to  be  good  enough  to  suggest  that  testing 
at  an  eight  year  interval  would  be  acceptable. 

From  the  above  discussion,  it  appears  imlikley  that  any  Class  1  or  Class  2  relief  valve  can 
operate  for  an  entire  eight  year  maintenance  cycle  without  testing.  Therefore,  to  eliminate  the 
need  for  frequent  shutdowns  a  method  to  either  remove  or  test  these  relief  valves  on-line  must  be 
developed. 

3.5.1.2  Motor  Operated  Valves 

The  candidate  PWR  has  surveillances  involving  motor  operated  valves  (MOVs)  which  can¬ 
not  be  performed  on-line  and,  based  on  industry  experience  with  motor  operated  valve  (MOV) 
performance  and  subsequent  regulatory  response,  are  unlikely  to  have  their  performance  inter¬ 
val  extended.  Nuclear  power  plant  operating  experience,  valve  performance  problems  and  MOV 

I 

^Subsequent  updates  to  "The  Operations  and  Maintenance  of  Nuclear  Power  Plants,"  have  occured  but  the  1989 
Edition  of  Section  XI  is  referenced  in  10  CFR  §50.55a(b). 


research  have  revealed  that  the  focus  of  the  ASME  Code  on  stroke  time  and  leak-rate  testing  for 
MOVs  was  not  sufficient  in  light  of  the  design  of  the  valves  and  the  conditions  under  which 
they  must  function.  For  this  reason,  on  June  28,  1989,  the  NRC  staff  issued  Generic  Letter  (GL) 
89-10,  "Safety-Related  Motor-Operated  Valve  Testing  and  Surveillance."  In  GL  89-10,  the  staff  re¬ 
quested  that  licensees  and  permit  holders  ensure  the  capability  of  MOVs  in  safety-related  systems 
to  perform  their  intended  functions  by  reviewing  MOV  design  bases,  verifying  MOV  switch  set¬ 
tings  initially  and  periodically,^  testing  MOVs  under  design-basis  conditions  where  practicable, 
improving  evaluations  of  MOV  failures  and  necessary  corrective  action,  and  trending  MOV  prob¬ 
lems.  Generic  Letter  89—10  was  superceded  by  GL  96-05,  "Periodic  Verification  of  Design— Basis 
Capability  of  Safety-Related  Motor-Operated  Valves,"  issued  September  18, 1996. 

The  code  states  that  the  maximum  inservice  test  frequency  shall  not  exceed  ten  years.  In  GL 
96-05,  the  NRC  staff  agrees  with  this  condition  of  a  maximum  test  interval  of  ten  years  based 
on  current  knowledge  and  experience.  However,  in  addition  to  this  maximum  test  interval,  in  the 
case  where  a  selected  test  interval  extends  beyond  five  years  or  three  refueling  outages  (whichever 
is  longer),  GL  96-05  states  that  the  licensee  should  evaluate  information  obtained  from  valve 
testing  conducted  during  the  first  five-year  or  three-refueling-outage  time  period  to  validate  as¬ 
sumptions  made  in  justifying  the  longer  test  interval.  Based  on  performance  and  test  experience 
obtained  during  the  initial  interval,  a  licensee  may  be  able  to  justify  lengthened  MOV  periodic 
verification  intervals. 

As  discussed  in  GL  96-05,  the  NRC  staff  has  long  recognized  the  limitations  of  using  stroke¬ 
time  testing  as  a  means  of  monitoring  the  operational  readiness  of  MOVs  and  has  supported  in¬ 
dustry  efforts  to  improve  MOV  periodic  monitoring  under  the  in-service  testing  (1ST)  program 
and  GL  89-10.  As  such,  the  staff  would  consider  a  periodic  verification  program  that  provides  an 
acceptable  level  of  quality  and  safety  as  an  alternative  to  the  current  1ST  requirements  for  stroke¬ 
time  testing  and  could  authorize  such  an  alternative,  upon  application  by  a  licensee,  pursuant  to 
the  provisions  of  10CFR50.55a(a)(3)(i). 

Licensees  of  several  facilities  (for  example,  Callaway,  Monticello,  and  South  Texas)  have  estab- 

®No  specific  periodicity  is  established  by  the  NRC.  However,  in  GL  89-10  the  NRC  suggested  that  the  MOV  data 
be  periodically  examined  (at  least  every  2  years  or  after  each  refueling  outage  after  program  implementation)  as  part 
of  a  monitoring  and  feedback  effort  to  establish  trends  of  MOV  operability.  These  trends,  according  to  the  NRC,  could 
provide  the  basis  for  a  licensee  revision  of  the  testing  frequency  established  to  periodically  verify  the  adequacy  of  MOV 
switch  settings. 


lished  MOV  periodic  verification  programs  that  the  staff  found  acceptable  during  closure  of  its 
review  of  GL  89-10  programs.  One  approach  to  MOV  periodic  verification  that  the  staff  found 
acceptable  is  to  diagnostically  test  each  safety-related  MOV  every  five  years  (or  every  three  refuel¬ 
ing  outages)  to  determine  thrust  and  torque  motor-actuator  output  and  any  changes  in  the  output. 
A  specific  margin  to  account  for  potential  degradation  such  as  that  caused  by  age  (in  addition  to 
margin  for  diagnostic  error,  equipment  repeatability,  load-sensitive  behavior,  and  lubricant  degra¬ 
dation)  is  established  above  the  minimum  thrust  and  torque  requirements  determined  under  the 
GL  89-10  program.  The  selection  of  MOVs  for  testing  and  their  test  conditions  should  take  into 
accoxmt  safety  significance,  available  margin,  MOV  environment,  and  the  benefits  and  potential 
adverse  effects  of  static  and  dynamic  periodic  verification  testing  on  the  selected  MOV  sample. 
Measures  such  as  grouping  and  sharing  of  valve  performance  between  facilities  are  appropriate 
to  minimize  the  need  to  conduct  more  rigorous  periodic  verification  tests. 

Two  significant  conclusions  can  be  drawn  from  the  above  discussion.  First,  a  periodic  veri¬ 
fication  program  that  actually  strokes  the  MOV  is  the  minimum  acceptable  requirement  to  ver¬ 
ify  operability.  Second,  the  longest  periodicity  deemed  acceptable  by  the  NRG  is  five  years  and 
this  periodicity  is  based  on  utilization  of  historical  performance  of  the  actual  MOVS  for  trending. 
Therefore,  it  is  unlikely  that  the  testing  periodicity  of  a  new  MOV  can  be  established  at  eight  years 
until  sufficient  performance  data  can  be  collected  in  accordance  with  GL  89-10.  The  implication 
of  these  conclusions  is  that,  for  an  operating  cycle  length  greater  than  five  years,  an  acceptable 
on-line  MOV  testing  method  which  actually  strokes  the  valve  must  be  developed. 

3.5.1.3  Other  In-Service  Testing 

The  ASME  Boiler  and  Pressure  Vessel  Code,  Section  XI,  "Rules  for  In-Service  Inspection  of 
Nuclear  Power  Plant  Components,"  requires  that  all  safety  related  pumps  and  valves  be  tested 
for  operability  on  a  quarterly  basis.  In  some  instances,  performance  of  the  required  testing  is 
either  hazardous  or  impossible  to  perform  on-line.  The  owner/ operator  may  petition  the  NRG  to 
defer  the  surveillance,  using  a  risk-based  argument.  However,  deferral  has  only  been  previously 
granted  for  Refueling  and  Cold  Shutdown  surveillances.  Refueling  surveillances  are  those  which 
caimot  practically  be  performed  with  the  reactor  core  installed.  Cold  Shutdown  surveillances  are 
not  as  limiting  as  Refueling  surveillances,  but  still  cannot  be  performed  with  the  plant  on-line. 
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In  both  cases,  the  surveillances  involve  only  standby  systems  such  as  the  Residual  Heat  Removal 
System  and  the  Safety  Injection  System. 

If  a  plant  incurs  an  implanned  outage  during  the  operating  cycle  after  more  than  three  months 
from  the  last  in-service  testing  period,  the  ASME  code  requires  the  following  rules  be  followed 
for  all  surveillances  designated  as  Cold  Shutdown  Tests: 

•  Testing  is  to  commence  as  soon  as  practical  when  the  Cold  Shutdown  condition  is  achieved, 
but  no  later  than  48  hours  after  shutdown.  Testing  shall  continue  vmtil  all  testing  is  com¬ 
pleted  or  the  plant  is  ready  to  return  to  power. 

•  Completion  of  all  testing  is  not  a  prerequisite  to  return  to  power,  and  any  testing  not  com¬ 
pleted  during  one  cold  shutdown  should  be  performed  during  any  subsequent  cold  shut¬ 
down  starting  with  those  tests  not  previously  completed. 

•  Testing  need  not  be  performed  more  often  than  once  every  3  months. 

•  In  the  case  of  an  extended  cold  shutdown,  the  testing  need  not  be  started  within  48  hours, 
but  all  Cold  Shutdown  Testing  must  be  completed  prior  to  returning  to  power. 

If  a  plant  operates  uninterrupted  for  an  entire  cycle,  cold  shutdown  testing  is  only  performed 
diuing  refueling  outages.  The  ASME  code  does  not  address  an  upper  limit  on  the  allowable 
length  between  Cold  Shutdown  Testing.  Technical  justification  would  be  necessary  to  extend  the 
permissible  interval  to  eight  years,  to  be  consistent  with  the  IRIS  cycle  length. 

3.5.1.4  Engineered  Safety  Features 

The  candidate  PWR  has  regulatory  based  surveillances  involving  three  similar  Engineered 
Safety  Feature  Actuation  System  tests  which  cannot  be  performed  on-line  and  which  are  unlikely 
to  be  extendable  to  eight  years.  These  are  integrated  tests  which  involve  sensors,  signal  processing, 
and  valve  and  pump  actuation.  The  tests  are: 

•  Diesel  Generator  Operability  and  Engineered  Safeguards  Pump  and  Valve  Response  Time 
Testing.  It  would  be  possible  to  devise  a  testing  procedure  which  would  test  the  integrated 
features  of  all  the  safety  systems  involved,  with  the  exception  of  actually  injecting  water 
into  the  core.  But  since  (cold)  water  injection  to  a  critical  reactor  would  risk  an  unacceptable 


power  excursion,  there  are  no  testing  scenarios  which  would  allow  this  test  to  be  performed 
safely  at  power.  This  test  is  central  to  proving  that  cooling  water  can  be  delivered  to  the 
core  in  sufficient  quantities  to  mitigate  postulated  accidents,  so  the  proof-of-flow  portion  is 
unlikely  to  be  deferrable. 

•  Actuation  of  Auto  Safety  Injection,  Containment  Building  Spray,  and  Control  Building  Air 
Systems.  This  surveillance  verifies  system  actuation  (and  appropriate  alarms)  within  allow¬ 
able  time  limits  upon  receipt  of  a  command  signal.  Because  response  time  includes  the  time 
for  the  components  to  physically  actuate  (i.e.,  valves  open  and  switches  close),  acceptable 
performance  is  unlikely  to  be  demonstrated  using  signal  monitoring  only. 

•  Emergency  Core  Cooling  Systems  Automatic  Actuation  Test.  This  surveillance  tests  that 
the  various  Emergency  Core  Cooling  System  components  will  realign  within  specified  time 
limits  upon  receipt  of  a  Safety  Injection  signal  including  the  initiation  of  feedwater  isolation, 
diesel  generator  start,  containment  isolation,  containment  ventilation  systems  isolation,  and 
primary  component  cooling  water  system  realignment.  This  test  carmot  be  conducted  on¬ 
line  due  to  feedwater  isolation,  and  because  of  it's  accident  mitigation  function  is  unlikely 
to  be  deferrable. 

These  surveillances  are  performed  to  ensure  that  necessary  safety  systems  are  operable  and 
will  perform  when  required.  Based  on  their  safety  importance,  they  cannot  be  deferred  eight  years 
to  the  refueling  outage.  Therefore,  a  method  to  verify  the  operability  of  these  systems  on-line  must 
be  developed.  Particularly  challenging  will  be  development  of  a  safe,  yet  thorough  and  effective, 
method  to  conduct  on-line  testing  of  those  components  which  involve  physical  operations  that 
present  a  safety  risk  (such  as  valve  actuation  which  would  permit  cold  water  injection  to  a  critical 
reactor). 

3.5.1.5  Steam  Generator  Eddy  Current  Testing 

Current  NRC  inspection  guidelines  for  steam  generators  require  eddy  current  testing  of  the 
steam  generator  tube  bundle  at  a  periodicity  of  up  to  40  months.  After  conducting  an  eddy  current 
inspection,  the  allowed  operating  period  until  the  next  required  inspection  is  established  by  the 
owner/ operator  after  analysis  of  all  previous  inspection  results.  The  40  month  periodicity  can  be 
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utilized  only  after  two  previous  successful  inspections  at  shorter  intervals  indicate  no  tube  degre- 
dation  has  occured  which  can  potentially  lead  to  tube  failure.  Although  there  are  development 
efforts  imderway,  there  currently  exists  no  method  for  on-line  steam  generator  tube  inspection. 
Based  on  previous  experience  within  the  nuclear  industry  with  tube  failures  due  to  stress  corro¬ 
sion  cracking  and  aging,  steam  generator  eddy  current  testing  is  unlikely  to  be  deferrable. 

As  a  preliminary  step  in  evaluating  a  transition  to  a  48  month  fuel  cycle,  the  candidate  PWR 
completed  a  draft  technical  request  to  the  NRC  to  extend  the  interval  between  steam  generator 
tube  inspections  to  50  months.  The  technical  evaluation  concluded  that  tube  degredation  over 
the  course  of  50  months  in  the  type^®  of  steam  generators  used  at  the  candidate  PWR  would 
not  reduce  the  margins  of  safety  required  by  NRC  Regulatory  Guide  1.121,  "Bases  for  Plugging 
Degraded  PWR  Steam  Generator  Tubes,"  August,  1976.  No  decision  was  made  on  this  request, 
however,  since  the  candidate  PWR  opted  to  pursue  (for  a  variety  of  other  reasons)  a  24  month 
operating  cycle  as  an  intermediate  step  to  an  extended  operating  cycle. 

Steam  generator  tubing  makes  up  a  significant  portion  of  the  reactor  coolant  pressure  boimd- 
ary  (RCPB),  and  the  industry-wide  historical  performance  dictates  that  inspections  be  conducted 
to  verify  the  integrity  of  this  boundry.  The  inspection  frequency  has  been  established  by  consider¬ 
ation  of  this  performance,  and  it  is  unlikely  that  it  will  be  feasible  to  extend  this  frequency  to  eight 
years.  Therefore,  an  on-line  inspection  method  (and  the  means  to  conduct  it)  must  be  developed. 

3.5.1.6  Rod  Drop  and  Rod  Position  Indication  Testing 

Control  and  shutdown  rod  drop  testing  is  currently  performed  at  the  candidate  PWR  follow¬ 
ing  refueling  to  guarantee  that  the  control  rods  have  an  unimpeded  path  to  the  bottom  of  the  core 
and  that  maximiun  drop  times  are  consistent  with  the  assumed  drop  times  used  in  the  plant  safety 
analysis. 

The  NRC  Improved  Standard  Technical  Specifications  only  require  rod  drop  testing  following 
vessel  head  removal,  and  no  upper  limit  to  the  periodicity  is  currently  specified.  However,  a 
senior  NRC  inspector  indicated  during  an  informal  discussion  that  the  decision  not  to  place  an 
upper  limit  on  the  periodicity  was,  in  part,  due  to  the  fact  that  no  current  plant  operates  on  a  cycle 

’“The  candidate  PWR  uses  four  Westinghouse  Model  F  steam  generators  with  5626  Thermally  Treated,  Inconel  600 
U-tubes  (SB-163)  hydraulically  expanded  into  the  tubesheet  at  each  end.  The  tube  bundle  is  supported  by  "V''-shaped 
Anti-Vibration  Bars  in  the  U-tube  bend  region  and  eight  stainless  steel  tube  support  plates. 
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length  where  fuel  swelling  would  be  a  significant  concem.^^  Since  IRIS  will  operate  on  a  cycle 
that  is  more  than  twice  the  length  of  the  longest  current  operating  cycle,  it  is  likely  that  an  upper 
limit  will  be  placed  on  rod  drop  testing  periodicity  and  that  it  will  be  less  than  eight  years. 

Rod  position  indication  testing  is  normally  conducted  in  conjxmction  with  rod  drop  testing, 
and  is  required  every  18  months.  For  the  candidate  PWR,  once  at  power  the  control  and  shut¬ 
down  rods  are  fully  withdrawn  and  remain  fully  withdrawn  with  long  term  reactivity  control 
maintained  by  primary  coolant  boron  inventory.  Since  the  relationship  between  actual  and  in¬ 
dicated  position  does  not  change  during  the  cycle  (as  long  as  the  rods  remain  fully  withdrawn), 
these  checks  can  be  deferred  (if  necessary)  past  18  months  to  the  scheduled  shutdown  period. 

If  control  rod  motion  is  used  for  long  term  reactivity  control,  instead  of  using  boron  inventory, 
then  the  assumption  that  the  relationship  between  actual  and  indicated  position  does  not  change 
during  the  cycle  is  no  longer  valid.  Under  these  conditions,  it  is  unlikely  that  the  rod  position 
indication  checks  would  be  deferrable  eight  years  to  the  scheduled  shutdown  period. 

3.5.1.7  Reactor  Coolant  Pumps 

Inspection  of  the  reactor  coolant  pump  flywheel  bore  and  keyway  are  ultrasonically  inspected 
for  volumetric  expansion  in  the  areas  of  highest  stress  concentration  every  36  months.  Addition¬ 
ally,  a  complete  surface  examination  of  all  exposed  reactor  coolant  pump  surfaces  and  a  complete 
ultrasonic  volumetric  examination  is  conducted  at  ten  year  intervals.  All  of  these  inspections  re¬ 
quire  the  reactor  coolant  pumps  to  be  secured. 

3.5.1.8  Electrical  Breaker  Checks 

There  are  several  safety  equipment  breaker  overcurrent  relay  checks  which  are  currently  per¬ 
formed  at  36  month  intervals  but,  due  to  their  importance  in  safety  assurance,  are  unlikely  to  be 
deferrable  to  eight  years. 

In  a  typical  three  zone  refueling  scheme  for  a  plant  with  a  24  month  operating  cycle,  a  batch  would  remain  in  the 
core  for  72  months.  However,  demonstration  that  the  controls  rods  have  an  unimpeded  path  to  the  bottom  of  the  core 
is  performed  every  24  months. 


3.5.2  Investment  Protection  Surveillances 


Investment  protection  surveillances  include  all  the  non-technical-spedfication-based  surveil¬ 
lances  performed  at  the  candidate  PWR.  A  small  number  of  these  are  performed  as  a  result  of 
commitments  to  agencies  other  than  the  NRC.  In  general,  however,  the  investment  protection 
surveillences  are  performed  in  the  mode  and  at  the  interval  selected  by  the  utility  to  protect  those 
systems  and  components  with  significant  investment  costs. 

For  this  investigation,  a  large  number  of  the  Category  B  investment  protection  surveillances 
have  been  summarily  dismissed  from  consideration  as  maintenance-related  barriers  to  the  eight 
year  operating  cycle.  These  siuveillances  involve  components  which  can  either  be  easily  removed 
from  the  design  (or  replaced  by  a  less  maintenance  intensive  component)  or  for  which  an  on¬ 
line  method  of  performance  could  readily  be  developed.  An  example  is  installing  an  instrument 
bypass  in  the  Reactor  Trip  System.  This  allows  on-line  testing  of  a  single  protection  channel 
without  the  test  signal  being  interpreted  by  the  protective  system  as  a  genuine  trip  signal,  and 
reduces  the  probability  of  receiving  a  spurious  protective  action. 

3.5.2.1  Relief  Valves 

At  the  candidate  PWR  there  are  several  relief  valve  investment  protection  surveillances  which 
cannot  be  performed  on-line  and,  based  on  component  operating  history,  the  testing  interval  can¬ 
not  be  extended.  The  relief  valves  are  Class  2  containment  boundary  valves,  of  the  same  design  as 
the  regulatory  based  relief  valves,  and  the  same  discussion  applies. 

3.5.2.2  Condenser  Waterbox 

The  main  condenser  is  the  primary  heat  sink  for  the  power  plant.  If  the  main  condenser  heat 
transfer  capability  is  degraded,  then  the  plant  must  either  operate  at  reduced  power  or  risk  con¬ 
denser  damage  due  to  overheating  and  overpressurization.  The  candidate  PWR  performs  con¬ 
denser  waterbox  cleaning  every  18  months,  during  which  all  steam  must  be  secured  since  the 
three  tube  bundles  are  not  individually  isolable.  Based  on  material  history,  this  interval  cannot  be 
extended. 
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3.5.2.3  Reactor  Coolant  Pumps 

There  are  eight  reactor  coolant  pump  surveillances,  all  involving  the  reactor  coolant  pump 
lubrication  oil  system,  which  require  the  pumps  to  be  secured  and  (based  on  material  history) 
cannot  be  performed  at  a  longer  interval.  These  surveillances  include  checking  the  pump  oil  hi/lo 
level  alarms,  lube  oil  sampling,  and  lube  oil  change. 

3.5.2.4  Main  Turbine 

The  main  turbine  and  generator  represent  a  substantial  capital  investment,  and  the  large  num¬ 
ber  of  surveillances  on  this  machine  reflect  the  magnitude  of  this  investment.  In  general  the  main 
turbine  system  surveillances  involve  the  speed  govemer,  lubricating  oil  system,  and  generator 
electrical  components.  The  generator  surveillances  are  all  performed  at  72-96  month  intervals, 
and  in  general  surveillance  results  at  the  operating  PWR  have  been  satisfactory  suggesting  that 
all  these  surveillances  could  be  extended  to  eight  years.  However,  the  main  turbine  speed  gov¬ 
emer  and  lubricating  oil  system  surveillances  are  unlikely  to  be  extended  past  48  months. 

3.5.2.5  Main  Steam 

There  are  several  surveillances  on  the  main  steam  isolation  valves  involving  component  re¬ 
placement  (software  and  solenoids)  which  could  physically  be  performed  on-line,  but  are  neces¬ 
sarily  performed  off-line  since  isolation  valve  operation  is  prevented  during  performance  of  the 
surveillances.  The  main  steam  relief  valves  require  periodic  lift  testing  and,  like  all  other  relief 
valves,  are  unisolable  from  the  system  and  thus  must  be  tested  off-line. 

3.6  Summary 

This  chapter  presented  the  maintenance  related  operating  cycle  length  barriers  existing  in  the 
surveillance  program  of  a  currently  operating  PWR.  A  tabular  summary  of  these  barriers  in  pre¬ 
sented  in  Appendix  A.  After  review  of  the  off-line  portion  of  the  operating  PWR  surveillance 
program,  54  surveillances  are  identified  as  definite  barriers  and  another  381  have  been  identified 
as  potential  barriers.  Of  these  barriers,  some  will  be  eliminated  by  design  differences  between  the 
operating  PWR  and  IRIS  while  the  rest  will  need  to  be  eliminated  be  design. 


It  is  not  the  intent  of  this  thesis  to  resolve  all  the  cycle  length  barriers.  However,  this  evaluation 
of  the  maintenance  related  operating  cycle  length  barriers  provides  the  foundation  to  develop  a 
methodology  which  will  assist  the  reactor  plant  designer  in  designing  systems  which  are  not  cycle 
length  limiting.  To  achieve  the  IRIS  operating  cycle  length  goal,  all  surveillances  must  either 
be  conducted  with  the  plant  at  power  or  have  a  maintenance  periodicity  at  least  as  long  as  the 
refueling  outage  interval. 


Chapter  4 


Surveillance  Resolution  Strategy 

4.1  Introduction 

This  chapter  outlines  the  strategy  used  to  resolve  the  maintenance-related  barriers  identified  in 
the  candidate  PWR  surveillance  program.  First,  the  surveillances  are  categorized  to  identify  how 
they  will  be  addressed  relative  to  IRIS.  Next,  the  methods  which  may  lead  to  on-line  performance 
or  complete  elimination  of  these  surveillances  are  presented.  After  evaluating  the  surveillances  for 
on-line  performance  or  elimination,  those  surveillances  which  remain  are  those  requiring  design 
resolution. 

4.2  Surveillance  Categorization  Relative  to  IRIS 

With  respect  to  IRIS,  the  operating  PWR  surveillances  can  be  placed  into  one  of  four  categories: 

Category  1;  On-line  surveillances  which  will  be  performed  on-line  in  IRIS; 

Category  2:  Candidate  surveillances  for  design  resolution  to  create  an  on-line  performance 
mode  in  IRIS; 

Category  3:  Surveillances  requiring  further  analysis  to  determine  performance  mode  in  IRIS; 
and. 

Category  4:  Off-line  surveillances  likely  to  have  performance  interval  extended  to  at  least 
eight  years  in  IRIS. 


The  flowchart  in  Figure  4-1  shows  how  the  operating  PWR  surveillances  (Categories  A,  B,  and  C) 
are  segregated  into  these  four  numerical  categories.  This  thesis  will  focus  on  those  surveillances 
requiring  design  resolution.  Category  2.  Beginning  with  all  surveillances  performed  at  the  oper¬ 
ating  PWR,  it  can  reasonably  be  expected  that  an  on-line  performance  mode  in  IRIS  can  be  found 
for  those  operating  PWR  surveillances  currently  performed  on-line.  It  can  also  be  expected  that, 
although  likely  few  in  number,  there  exists  surveillances  that  are  likely  to  have  their  performance 
intervals  extended  to  at  least  eight  years.  After  removing  these  two  groups,  the  operating  PWR 
off-line  and  shutdown  surveillances  remain.  These  can  be  immediately  segregated  into  those  per¬ 
formed  off-line  at  less  than  48  month  intervals  (i.e.,  those  analyzed  by  Moore)  and  those  with  a 
performance  interval  greater  than  48  months  or  performed  shutdown. 

Although  they  are  expected  to  be  characterized  by  the  Category  2  surveillances,  those  surveil¬ 
lances  with  a  performance  interval  greater  than  48  months  or  performed  shutdown  were  not 
specifically  analyzed  by  Moore  and  will  not  be  analyzed  here.  These  surveillances  are  imme¬ 
diately  carried  down  to  the  'further  analysis'  category.  Of  those  surveillances  performed  off-line 
at  less  than  48  month  intervals,  many  have  an  on-line  performance  mode  and  are  thus  placed  in 
the  'IRIS  online'  category.  The  remaining  435  operating  PWR  surveillances  (54  Category  C  plus 
381  Category  B)  which  are  currently  performed  off-line  and  do  not  have  an  on-line  performance 
mode  are  the  potential  IRIS  cycle  length  barriers. 

From  this  group  of  435  surveillances  a  qualitative  assesment  will  be  made  as  to  whether  the 
surveillance  plausibly  could  have  an  on-line  performance  mode  in  IRIS,  based  on  the  IRIS  design 
goals  and  objectives.  Included  in  this  category  are  surveillances  which  are  not  required  in  IRIS 
based  on  expected  configuration  differences  between  the  operating  PWR  and  IRIS.  However,  as 
seen  in  Figure  4-1,  these  surveillances  are  carried  into  the  'further  analysis'  category  since  any 
change  in  the  IRIS  design  goals  and  objectives  may  make  them  applicable.  Those  surveillances  for 
which  an  on-line  mode  is  not  plausible  are  carried  down  to  the  'design  resolution'  category. 

The  last  category  includes  those  surveillances  which  plausibly  could  have  their  performance 
interval  extended  to  eight  years.  A  separate  category  was  created  for  these  surveillances,  but  it  is 
anticipated  that  they  will  be  few  in  number. 


54 


4.3  Resolution  Categorization  Considerations 

The  remainder  of  this  chapter  describes  in  greater  detail  the  considerations  given  when  catego¬ 
rizing  the  operating  PWR  surveillances  according  to  Figure  4-1.  Although  imable  to  be  captured 
here,  engineering  judgement  and  experience  are  critical  to  proper  evaluation  and  categorization 
of  the  surveillances.  Costly  design  mistakes  can  often  be  avoided  by  having  an  seasoned  designer 
compare  the  design  team's  evaluation  against  previous  design  efforts. 

4.3.1  Plausibly  On-Line  or  Eliminated  Surveillances 

All  investment  protection  surveillances  can  be  considered  for  elimination  or  performance  in¬ 
terval  extension,  since  their  performance  mode  and  interval  are  generally  not  established  by  reg¬ 
ulatory  authority.  However,  since  the  intent  of  these  surveillances  is  to  protect  a  large  capital 
investment,  categorically  eliminating  these  surveillances  is  neither  prudent  nor  responsible.  Anal¬ 
ysis  must  consider  the  cost  of  performing  the  surveillance  (including  planned  outage  downtime 
costs)  against  the  cost  of  unexpected  failure  (include  forced  outage  costs)  if  the  surveillance  is  not 
performed.  However,  this  investigation  is  based  on  the  premise  that  the  IRIS  cycle  length  ob¬ 
jective  is  a  key  factor  in  making  IRIS  desirable  to  a  potential  customer  and  thus  economics  will 
only  be  considered  on  a  qualitative  basis,  and  only  when  the  cost  impact  of  a  particular  decision 
is  significant. 

Regulatory  surveillances,  on  the  other  hand,  are  unlikely  to  be  eliminated  since  their  basis  is 
ensuring  protection  of  the  public.  It  is  possible,  however,  that  an  acceptable  alternative  surveil¬ 
lance  can  be  created  which  provides  the  same  safety  assurance.  The  NRC  has  indicated  a  will¬ 
ingness  to  consider  alternatives  as  long  as  the  proposed  method  demonstrates  operability  and  is 
adequately  supported  by  technical  justification.  For  example,  the  NRC  acknowledges  the  limi¬ 
tations  of  stroke-time  testing  of  MO  Vs  in  assessing  operational  readiness.  It  has  stated  it  would 
consider  authorizing  a  testing  program  which  provides  an  acceptable  level  of  quality  and  safety 
in  lieu  of  stroke-time  testing  to  meet  1ST  requirements.^ 

Because  of  their  importance  in  demonstrating  the  ability  to  perform  safety  functions,  regu¬ 
latory  based  surveillances  are  imlikely  to  have  their  periodicity  extended  to  be  compatible  with 
’NRC  Generic  Letter  89-10 


56 


the  IRIS  operating  cycle  length  until  sufficient  historical  data  is  collected  (at  testing  intervals  less 
than  eight  years)  to  provide  technical  justification  for  extension.  Therefore,  unless  the  first  several 
IRIS  operating  cycles  are  of  the  same  length  as  currently  operating  PWR  cycles  (to  collect  in-situ 
historical  data)  these  surveillances  must  either  be  performed  on-line  or  eliminated  by  design.  To 
provide  for  am  on-line  performance  mode,  the  applicable  system  or  component  must  either  be  able 
to  be  temporarily  taken  out  of  service  for  testing  without  compromising  operational  safety  or  be 
able  to  be  tested  without  interrupting  the  operability  of  the  component. 

To  eliminate  a  surveillance  the  function  performed  by  the  component  or  system  must  be  per¬ 
formed  by  a  different  set  of  components  for  which  the  surveillance  is  not  applicable,  or  the  func¬ 
tional  requirement  must  be  eliminated  completely.  Although  this  objective  is  similar  to  the  ob¬ 
jective  of  the  'design  resolution'  category,  these  eliminated  surveillances  are  those  for  which  a 
readily  apparent  solution  is  available.  Based  on  IRIS  design  objectives  and  goals,  there  will  be  no 
chemical  and  volume  control  system  and  therefore  all  operating  PWR  surveillances  on  this  sys¬ 
tem  are  eliminated  in  IRIS.  Note,  however,  that  these  surveillances  are  carried  into  Category  2 
(design  resolution)  since  elimination  is  the  design  resolution  made  at  a  particular  stage  in  the  de¬ 
sign.  If  the  design  changes  to  include  a  chemical  and  volume  control  system,  then  the  applicable 
surveillances  must  be  resolved  again  in  terms  of  the  current  design  objectives  and  goals. 

4.3.1.1  Advanced  Monitoring  Techniques 

Advances  in  remote  and  on-line  monitoring  techniques  now  allow  for  conducting  many  in¬ 
spections  at  power  in  locations  which  are,  due  either  to  environment  or  radiation,  unaccessible 
by  personnel.  Examples  of  these  techniques  include  robot  assisted  ultrasonic  inspection,  on-line 
motion  and  vibration  monitoring,  and  radiation  hardened  infrared  imaging.  A  common  charac¬ 
teristic  of  all  these  techniques  is  that  they  are  passive,  non-destructive,  and  non-invasive. 

Selection  of  representative  indications  which  can  be  monitored  by  these  advanced  techmques 
to  adequately  characterize  the  condition  of  the  component  can  produce  a  two-fold  benefit.  First, 
the  investment  is  better  protected  by  more  frequent  (or  even  continuous)  assessment  of  component 
condition  without  requiring  an  outage.  Second,  these  techniques  are  generally  passive  and  no 
testing-induced  failures  (which  can  occur  with  a  time-based  surveillance  program)  are  expected. 

For  microprocessor  controlled  components  and  systems,  integral  diagnostics  can  be  included 


in  the  control  logic  which  routes  short  duration  (i.e.,  too  short  to  cause  component  or  system 
response)  signals  throughout  the  entire  circuit  to  verify  electronic  continuity.  Although  this  does 
not  demonstrate  component  response  to  the  applied  signal,  it  does  minimize  the  amoimt  of  the 
system  for  which  assured  operation  is  uncertain. 

4.3.1.2  Improved  Technologies 

Many  commercial  industries  have,  over  the  past  several  decades,  taken  a  critical  look  at  their 
maintenance  practices  in  a  focused  effort  to  reduce  operating  and  maintenance  costs.  As  a  re¬ 
sult,  a  new  generation  of  highly  reliable  and  more  easily  maintained  components  have  emerged 
from  vendors  and  manufacturers.  In  most  cases  the  capital  expenditure  to  backfit  a  operating 
PWR  with  these  new  components  is  not  justified  by  the  reduced  maintenance  return,  since  the 
operating  PWR  operating  cycle  length  is  currently  short  enough  to  perform  effective  (although 
frequent)  maintenance  on  the  older  components.  New  design  and  construction,  however,  affords 
the  opportunity  to  take  advantage  of  these  component  improvements. 

Switchboard  and  breaker  technology,  for  example,  has  improved  significantly.  Fully-enclosed 
switchboards  are  now  available  which  do  not  require  frequent  cleaning.  These  enclosed  switch¬ 
boards  can  also  be  fitted  with  infrared  sensors  and  fire  extinguishing  agents  to  minimize  the  im¬ 
pact  of  electrical-related  fires.  The  air  circuit  breaker  will  soon  give  way  to  the  solid-state  breaker, 
based  on  power  electronics  building  block  (PEBB)  technology  (Figure  4-2).  Solid-state  breakers 
under  development  contain  the  integral  diagnostics  discussed  above  which  can  verify  the  oper¬ 
ability  of  breaker  protective  features  without  interrupting  power  to  the  load.^  Solid-state  breakers 
based  on  PEBB  technology  can  also  be  used  in  an  electrically-reconfigurable  electric  power  dis¬ 
tribution  system,  allowing  for  multiple  power  sources  for  a  vital  component  without  the  need 
for  relays  or  bus  transfer  switches.^  Application  of  these  technologies  will  eliminate  the  need  to 
secure  a  load  in  order  to  inspect  and  verify  proper  operation  of  the  load's  power  supply. 

^U.S.  Navy  Office  of  Naval  Research,  http:/ /pebb.onr.navy.mil. 

Borraccini,  J.,  W.  Ruby,  T.  Ouong,  E).  Cochran,  E.  Roth,  D.  McLaughlin,  and  T.  Ericsen,  ^^Demonstration  of  Power 
Electronic  Building  Block  (PEBBl)  Function  and  Plans  for  PEBB2  and  PEBB3,”  Government  Microcircuit  Applications 
Conference  (GOMAC),  Las  Vegas,  March,  1997. 
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Figure  4-2:  Power  Electronics  Building  Block  Functional  Diagram 

4.3.1.3  Redundant  Capabilities 

Many  investment  protection  calibrations  and  alignments  can  have  their  periodicity  extended 
by  installation  of  diverse,  reliable,  and  redimdant  monitoring  capability.  Methods  selected  should 
operate  different  enough  (with  different  calibration  curve  slopes  and  failure  indications)  so  that 
the  instruments  cannot  drift  the  same  way  and  provide  a  consistent  inaccurate  indication.  This 
will  ensure  that  consistent  indication  correlation  between  these  redundant  monitoring  methods 
is  accurate  and  reliable,  eliminating  the  need  for  instrument  calibrations  and  alignments  until  a 
divergence  of  these  redundant  monitoring  methods  is  indicated. 

4.3.1.4  Regulatory  Change 

As  noted  previously,  the  NRC  has  indicated  a  willingness  to  consider  alternatives  to  current 
testing  requirements  as  long  as  adequate  technical  justification  is  provided.  However,  since  this 
technical  justification  is  based  on  the  performance  of  a  particular  component  in  a  particular  ap¬ 
plication,  it  is  unlikely  that  a  significant  number  of  regulatory  changes  would  be  approved  for 
simultaneous  application  in  a  new  reactor  plant  design  where  no  performance  history  exists. 


4.3.2  Surveillances  Requiring  Design  Resolution 


After  evaluating  the  off-line  surveillances  for  a  plausible  on-line  solution  (or  elimination),  the 
remaining  surveillances  are  those  which  prevent  attaining  the  IRIS  cycle  length  objective.  Al¬ 
though  this  category  is  populated  by  discrete  components,  the  aggregate  set  represents  the  general 
challenges  to  IRIS  for  which  a  systematic  methodology  for  resolution  must  be  found. 

Where  design  is  necessary  to  create  an  on-line  performance  mode,  the  preferred  order  of  design 
is: 


1)  utilize  existing  components, 

2)  utilize  existing  technologies, 

3)  develop  new  components/systems,  and 

4)  develop  new  technologies. 

In  order,  each  method  involves  increasing  design  effort  and  risk. 

The  reader  is  reminded  that  the  objective  of  this  thesis  is  not  to  resolve  all  435  surveillances 
identified  above,  but  rather  to  categorize  the  barriers  in  more  general  terms  such  as  classes  of 
components  which  share  common  limitations.  It  is  from  these  generalizations  that  the  resolution 
methodology  will  be  developed,  so  that  design  resolution  of  particular  IRIS  maintenance-related 
barriers  can  be  made. 

4.4  Summary 

This  chapter  has  outlined  the  methods  available  to  the  designer  which  can  be  used  to  resolve 
identified  operating  cycle  length  barriers.  The  strategy  for  eliminating  these  barriers  is  "defer  if 
practical,  perform  on-line  when  possible,  and  eliminate  by  design  where  necessary."  Evaluating 
surveillances  for  deferral  requires  in-depth  analysis  of  the  surveillance  basis  and  the  component's 
maintenance  history.  This  evaluation  is  outside  the  objectives  of  this  thesis,  but  is  necessary  in  any 
reactor  plant  design  effort.  Chapter  5,  'Eliminating  the  Maintenance-Related  Barriers,'  outlines  the 
methodology  used  to  address  those  surveillances  categorized  as  requiring  an  on-line  performance 
mode  or  elimination. 
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Chapter  5 


Eliminating  the  Maintenance-Related 
Barriers 

5.1  Introduction 

This  chapter  presents  the  resolution  methodology  which  is  utilized  to  assist  in  resolving  the 
identified  operating  cycle  length  barriers.  It  is  structured  as  a  flowchart,  which  methodically  and 
systematically  evaluates  the  current  state  of  the  design  against  the  requirements,  objectives,  and 
goals.  In  Section  5.4,  each  of  the  decision  points  and  process  are  described.  The  intent  of  devel¬ 
oping  this  methodology  is  not  to  introduce  new  factors  for  the  designer  to  consider,  but  rather  to 
organize  the  relevant  factors  into  a  methodology  which  will  assist  in  identifying  where  the  design 
effort  should  be  focused. 

5.2  Establishing  the  Solution  Space 

To  ensure  that  IRIS  maintenance  considerations  are  evaluated  in  the  design  process,  the  main¬ 
tenance  requirements  must  be  identified  prior  to,  or  concurrent  with,  the  design  formulation. 
However,  for  a  design  such  as  IRIS  which  will  deviate  significantly  from  current  commercial  PWR 
practice,  these  requirements  are  not  well  known.  These  maintenance  requirements,  although  not 
nearly  as  well  defined  as  the  known  limitations  of  operating  PWR  components,  represent  poten¬ 
tial  barriers  to  attaining  the  IRIS  objectives. 
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Figure  5-1:  Resolution  of  Maintenance  Related  Barriers  Relevant  to  IRIS  Design 


The  maintenance-related  barriers  will  be  identified  using  a  concurrent  top-down  and  bottom- 
up  approach.  The  top-down  approach  starts  with  the  operating  PWR  and  identifies  barriers  based 
on  maintenance  requirements  and  component  operating  history  (Chapter  3,  'Operating  Pressur¬ 
ized  Water  Reactor  Surveillance  Program').  The  bottom-up  approach  starts  with  the  IRIS  design 
requirements  to  determine  the  best  design  solutions  to  meet  the  design  requirements.  It  is  the 
IRIS  design  requirements  and  solutions  that  determines  which  operating  PWR  systems  and  com¬ 
ponents  could  potentially  find  use  in  IRIS.  From  this  aggregate  set  of  components/systems  and 
their  accompanying  maintenance-related  barriers,  the  preferred  method  of  resolution  (evolution¬ 
ary  or  revolutionary  design)  will  be  identified.  This  is  shown  graphically  in  Figure  5-1. 


5.3  Resolving  the  Barriers 


The  designer  can  deal  with  maintenance-related  barriers  in  one  of  three  ways: 

1.  Modification:  Modify  the  component  such  that  the  barrier  no  longer  exists  {evolutionary  de¬ 
sign), 

2.  Substitution:  Perform  the  limiting  component's  function  using  a  different  component  that  is 
not  subject  to  the  limitation  (combination  of  evolutionary  and  revolutionary  design),  or 

3.  Replacement:  Use  an  entirely  different  method  to  perform  the  fvmctional  requirement  {revo¬ 
lutionary  design). 

The  method  to  be  utilized  depends  on  a  number  of  factors  including  cost,  technical  risk,  en¬ 
gineering  feasibility,  and  effectiveness.  It  is  not  possible  to  determine  the  best  method  without 
considering  all  of  these  factors. 

5.4  Resolution  Methodology 

This  section  presents  the  resolution  methodology  used  to  synthesize  the  requirements  into  de¬ 
sign  solutions.  It  is,  and  is  intended  to  be,  general  in  nature  for  maximum  applicability.  Design 
inherently  requires  a  high  degree  of  creative  thought  and  engineering  judgment,  and  these  in¬ 
tangibles  cannot  be  captured  in  any  methodology.  What  is  asserted  is  that  given  a  framework  to 
guide  this  creativity,  innovative  solutions  can  more  readily  be  developed. 

With  the  inputs  providing  the  requirements,  the  methodology  must  systematically  address 
all  the  imposed  requirements  to  generate  design  solution  alternatives  for  consideration  by  the 
systems  engineer  in  the  overall  design.  This  resolution  methodology  should  perform  as  a  transfer 
function,  inputting  the  cumulative  set  of  requirements  and  outputting  possible  solutions  meeting 
the  requirements.  To  be  of  utility  to  the  systems  engineer,  the  design  solution  alternatives  must 
also  be  qualitatively  ranked  by  maintainability. 

The  design  resolution  methodology  flowchart  is  organized  into  three  sequential  figures,  as 
shown  in  Figure  5-2.  The  flowchart  is  presented  in  Figures  5-3  through  5-5.^  Conceptually,  the 

'The  legend  in  Figure  5-3  applies  to  all  three  figures. 


63 


Figure  5-2:  Design  Resolution  Methodology  Flowchart  -  Layout 


flowchart  sequentially  and  logically  steps  through  the  inputs  described  in  Section  2.2  ('Methodol¬ 
ogy  Inputs')  and  identifies  where  design  effort  must  be  focused; 

•  Figure  5-3  s)mthesizes  the  requirements  and  evaluates  what  level  of  design  effort  is  required 
(use  existing  component,  modify  component,  or  design  new  component). 

•  Figure  5-4  synthesizes  maintainability  into  the  design  to  resolve  when  and  how  the  compo¬ 
nent  will  be  maintained. 

•  Figure  5-5  s)mthesizes  the  economic  and  investment  protection  constraints  to  fully  meet  all 
design  objectives. 

The  various  decisions  and  processes  of  the  Design  Resolution  Methodology  Flowchart  are  dis¬ 
cussed  in  more  detail  below: 

5.4.1  Decisions 

This  is  the  fundamental  question  that  determines  whether  or  not  a  currently  used 
component  can  be  used  in  the  IRIS  application.  If  this  is  the  first  iteration,  the 
component  currently  used  to  meet  these  functional  requirement  is  input  for  con¬ 
sideration.  This  is  a  logical  starting  point,  since  design  effort  should  only  be 
expended  if  necessary  to  minimize  the  number  of  unproven  components  in  the  design.  In  most 
cases,  the  component  currently  used  will  meet  the  functional  requirements  in  the  IRIS  application 
leading  to  an  attempt  to  use  the  component.  Subsequent  passes  through  the  methodology  will 
lead  to  modifications  to  the  currently  used  component  or  a  new  component  or  system. 

If  the  currently  used  component  fails  to  meet  the  functional  requirements  (first 
iteration)  or  result  in  a  feasible  design  (subsequent  iterations)  then  the  next  iter¬ 
ation  looks  for  modifications  to  the  currently  used  component.  Since  the  limita¬ 
tions  of  the  currently  used  component  have  been  identified  by  the  methodology 
(either  upon  entry  to  the  flowchart  or  after  a  complete  iteration  loop),  the  scope  of  the  necessary 
changes  are  apparent  to  the  designer.  The  anticipated  commercial  manufacturing  capability  is 


65 


used  to  determine  feasible  component  modifications  which  will  meet  the  requirements.  This  is 
the  first  point  in  the  methodology  where  creative  (evolutionary  design)  effort  is  required. 

If  the  component  under  consideration  cannot  be  modified  to  satisfy  the  require¬ 
ments,  then  a  new  (revolutionary  design)  approach  to  the  requirements  is  re¬ 
quired.  At  this  point,  the  designer  must  turn  to  emerging  materials  and/or  tech¬ 
nologies  and  seek  a  creative  design  solution.  If  a  new  component  or  system  can¬ 
not  be  developed,  then  the  functional  requirements  must  be  re-evaluated  and  distributed  among 
several  components. 

This  is  the  first  assessment  of  the  design  against  the  ultimate  goal,  operation 
throughout  the  entire  cycle  without  requiring  a  plant  shutdown  for  maintenance. 
To  reach  this  point  a  component,  group  of  components,  or  system  has  been  con¬ 
ceived  which  meets  the  specified  functional  requirements.  The  component  is 
evaluated  against  the  regulatory  requirements,  with  bias  given  (if  an  existing  component  is  be¬ 
ing  used)  to  the  maintenance  history  of  the  component.  If  the  component  is  not  substantially 
modified,  then  the  existing  regulatory  requirements  will  likely  still  be  applicable.  However,  if  sig¬ 
nificant  component  modification  has  occured  (or  a  new  component  designed)  then  the  regulatory 
requirements  must  be  postulated  from  the  regulatory  intent  (Section  2.2.2,  'Regulatory  Require¬ 
ments'). 

If  the  design  meets  the  operating  cycle  length  requirement,  then  no  maintenance  is  required  for 
the  cycle  duration  and  the  design  proceeds  to  economic-related  evaluation.  If  the  component  does 
not  meet  the  operating  cycle  length  requirements,  due  to  either  performance  history  or  regulatory 
requirements,  then  a  method  of  maintaining  the  component  during  the  cycle  must  be  developed. 

If  the  role  of  the  component  in  overall  operations  is  such  that  the  component 
can  safely  be  isolated  for  maintenance,  then  the  component  will  be  evaluated  for 
at-power  accessibility.  In  this  case,  often  times  all  that  is  required  is  to  install 
sufficient  capability  to  isolate  the  component  from  the  system.  However,  some 
components  cannot  be  secured  at  power  and  require  plant  shutdown.  If  the  component  cannot 


be  isolated,  then  a  method  of  maintaining  the  component  on-line  must  be  developed  to  avoid  the 
necessity  for  plant  shutdown  to  maintain  that  component. 

Components  that  reach  this  point  are  those  that  can  be  safely  taken  out  of  ser¬ 
vice  for  maintenance.  If  the  component  is  accessible  then  the  component  can  be 
isolated  and  maintained  on-line,  and  the  design  proceeds  to  economic-related 
evaluation.  However  many  components,  particularly  those  inside  the  contain¬ 
ment  building,  will  be  inaccesible  due  to  a  high  temperature  or  high  radiation  environment.  For 
these  components,  an  on-line  maintenance  capability  must  be  provided. 

Components  that  reach  this  point  are  those  that  require  an  on-line  maintenance 
method.  On-line  maintenance  methods  are  input;  existing  methods  for  the  first 
iteration  and  proposed  methods  for  subsequent  iterations.  If  a  suitable  on-line 
maintenance  method  is  available  (or  proposed),  then  the  design  proceeds  to 
economic-related  evaluation.  If,  however,  a  suitable  on-line  maintenance  method  is  not  available 
then  evaluation  of  other  at-power  maintenance  methods  is  conducted. 

Installation  of  redundacy  often  solves  the  maintainability  issue  for  small  com¬ 
ponents  which  cannot  be  removed  from  service  at  power,  such  as  pumps  and 
valves.  For  larger  components,  such  as  heat  exchangers  and  turbine  generators, 
this  becomes  cost  prohibitive.  However,  in  the  development  of  design  alterna¬ 
tives,  installation  of  redundancy  may  be  the  only  solution  for  at-power  maintenance. 

Note  that  installation  of  redundancy  is  only  effective  for  components  that  are  accessible  at- 
power  unless  sufficient  'installed  spares'  are  provided  (to  operate  when  rurming  components  are 
'retired'  in-place)  to  achieve  the  desired  operating  cycle  length.  If  redundancy  cannot  be  provided, 
then  a  new  on-line  maintenance  method  must  be  developed  for  this  component. 


(Fig.W) 
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When  all  attempts  at  making  the  component  maintainable  at  power  through 
modifications  and  configuration  changes  fail,  a  new  on-line  method  for  main¬ 
taining  the  component  must  be  developed.  Like  installation  of  redundancy,  this 
path  may  lead  to  an  economically  non-viable  solution. 

Often,  technologies  which  may  lead  to  at-power  maintainability  are  only  in  the  early  stages  of 
development  and  thus  require  an  investment  (which  is  ultimately  reflected  in  the  total  plant  cost) 
to  adapt  these  developing  technologies  for  the  required  application.  If  an  on-line  method  can 
be  developed,  then  the  design  proceeds  to  economic-related  evaluation.  If  not,  then  this  design 
alternative  is  not  viable  in  it's  current  state  and  so  another  iteration  begins. 

This  is  the  final  check  of  the  design  alternative  to  ensure  that,  after  determina¬ 
tion  of  the  investment  protection  surveillance  requirements,  the  desired  operat¬ 
ing  cycle  length  can  still  be  achieved.  A  component  which  reaches  this  point  in 
the  methodology  can  only  fail  to  reach  the  desired  operating  cycle  length  due  to 
investment  protection  concerns.  If  this  is  the  case,  then  the  alternative  is  not  feasible  in  it's  current 
state  and  so  another  iteration  begins  (with  the  a  priori  knowledge  of  the  investment  protection 
surveillance  requirements). 

The  investment  protection  requirements  potentially  could  be  changed  to  be  consistent  with 
the  desired  operating  cycle  length.  However,  the  investment  protection  surveillance  requirements 
are  determined  based  on  risk  to  the  owner  and  are  independent  of  the  desired  operating  cycle 
length.  The  designer  must  resist  the  temptation  to  modify  these  requirements  to  make  the  design 
compatible  with  the  desire  operating  cycle  length  unless  the  risk  to  the  owner  is  re-evaluated, 
and  this  should  only  be  done  after  another  iteration  through  the  methodology  (which  will  now 
consider  the  investment  protection  surveillance  requirements). 
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If  all  possible  design  alternatives  have  not  been  generated  (i.e.,  consideration 
of  existing  component,  modified  component,  and  new  component(s))  then  the 
process  is  restarted  without  bias  towards  previously  generated  alternatives.  If 
all  feasible  design  alternatives  have  been  generated,  then  the  design  alternatives 
are  ranked  by  economic  feasibility  and  maintainability  and  the  procedure  is  exited. 

5.4.2  External  Processes 

Component  modification  seeks  to  make  a  minor  change  to  the  component  that 
is  with  current  manufacturing  capabilities.  The  objective  of  this  process  is  to 
make  the  changes  necessary  to  meet  the  fvmctional  (first  iteration)  or  cumulative 
(subsequent  iterations)  requirements  specified  for  the  component  without  also  requiring  a  new 
manufacturing  process.  In  some  cases,  the  necessary  changes  can  be  met  by  an  existing  component 
developed  for  a  different  application.  If  not,  then  a  custom  manufacturing  process  (based  on 
existing  manufacturing  practices)  will  need  to  be  developed. 

If  a  current  component  cannot  be  modified  to  meet  the  specified  functional  re¬ 
quirements,  then  a  new  component  must  be  designed.  This  typically  requires 
significantly  more  creative  design  effort  than  simple  component  modification, 
but  can  result  in  a  component  better  suited  for  the  specific  application  than  a  modified  existing 
component.  Although  design  of  a  new  component  matches  requirements  to  functionality,  devel¬ 
opment  and  testing  of  the  new  component  typically  involve  more  time  and  cost  than  modification 
of  an  existing  component. 

When  a  component  simply  cannot  be  isolated  for  maintenance  during  the  op¬ 
erating  cycle  without  a  shutdown,  then  a  means  of  maintaining  the  component 
on-line  must  be  developed.  In  many  cases,  the  maintenance  actions  required  to 
be  performed  are  inspections  which  allow  predictive  techniques  to  be  used  in  estimating  the  re¬ 
maining  length  of  satisfactory  operation  of  the  component.  Depending  on  the  basis  for  conducting 
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the  maintenance  (regulatory  requirement  or  investment  protection),  development  of  an  alternative 
inspection  method  which  provides  equivalent  data  on  the  overall  health  of  the  component  may 
be  acceptable. 

Recent  focus  on  predictive  maintenance  techniques  has  resulted  in  development  of  new  meth¬ 
ods  for  assessing  component  wear  and  performance.  However  many  of  these  technologies,  al¬ 
though  promising  for  future  use,  are  not  sufficiently  developed  to  transition  into  an  actual  field 
application.  Therefore,  utilization  of  these  immature  technologies  will  require  time  and  money  to 
research,  develop,  and  test  the  technology  for  field  application. 

Installation  of  redundancy  is  the  simplest  of  the  methods  for  creating  an  at-power 
maintainable  component,  so  long  as  the  component  is  accessible.  The  obvious 
drawback  to  this  method  is  capital  expenditure  for  installed  spare  components  in 
the  parallel  path(es),  especially  for  large  components  like  heat  exchangers  and  turbine  generators. 
Some  systems,  such  as  those  that  are  normally  subject  to  large  deviations  from  their  nominal 
operating  point,  lend  themselves  well  to  installation  of  redundancy.  An  example  is  a  cooling  water 
loop,  where  the  number  of  pumps  required  to  be  in  operation  is  dependent  on  the  temperature  of 
the  cooling  medium. 

Most  components  that  can  be  taken  out  of  service  for  at-power  maintenance  can 
be  made  accessible  by  physically  moving  the  component  to  an  accessible  loca¬ 
tion.  High  temperature  or  radiation  inside  the  containment  vessel  are  the  most 
common  reasons  that  a  component  is  inaccessible.^  Moving  the  component  to  an  accessible  often 
requires  only  an  additional  length  of  piping  or  cabling,  with  appropriate  consideration  given  to 
the  impact  of  that  addition  to  the  overall  design. 
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^The  IRIS  vessel  is  a  large  integral  vessel  with  internal  radiation  shield  plates  located  in  a  1.5  m  annulus.  Prelimi¬ 
nary  calculations  indicate  that,  due  this  thick  shielded  water  annulus,  the  dose  rate  adjacent  to  the  vessel  during  high 
power  operation  will  be  near  background.  The  compact  containment  design,  however,  may  result  in  high  temperatures 
(especially  at  high  elevations  within  the  containment). 


Evaluation  of  the  economics  of  a  design  decision  is  a  complex  process  which  in¬ 
volves  both  capital  and  O&M  cost  considerations.  The  viability  of  a  design,  and 
the  design  decisions  made  along  the  way,  depend  strongly  on  the  owner's  finan¬ 
cial  goals  and  objectives  which  are  usually  not  well  known  during  the  design  phase.  Therefore,  a 
baseline  'owner  profile'  must  be  established  to  place  the  other  external  factors  (such  as  projected 
market  conditions  or  the  cost  of  borrowing  money)  in  perspective. 

This  economic  analysis  is  beyond  the  scope  of  this  thesis,  but  is  included  in  the  methodol¬ 
ogy  for  completeness.  What  can  be  qualitatively  asserted,  however,  is  the  relative  economic  risk 
and  benefits  of  one  design  alternative  over  another.  In  later  chapters  of  this  thesis,  this  qualita¬ 
tive  assessment  will  be  substituted  for  detailed  economic  analysis  when  evaluating  IRIS  design 
alternatives. 

The  investment  protection  surveillance  requirements  applicable  to  a  particular 
design  alternative,  like  economic  viability,  are  strongly  dependent  on  the  owner. 
In  this  case,  the  owner's  economic  risk  threshold  directly  influences  the  amount 
of  investment  protection  maintenance  to  be  conducted.  In  general,  large  capital  expenditure  com¬ 
ponents  and  those  components  whose  operation  is  directly  linked  to  plant  output  receive  the  most 
maintenance  attention.  For  these  components,  failure  typically  results  in  plant  down-time  and 
high  component  repair  or  replacement  costs.  As  with  the  economic  analysis,  this  thesis  can  only 
qualitatively  estimate  the  investment  protection  surveillance  requirements  that  a  baseline  'owner 
profile'  would  establish. 

The  methodology  produces  several  design  alternatives  for  consideration  in  the 
overall  plant  design.  Ranking  these  alternatives  by  economic  viability  and  over¬ 
all  maintainability  is  essential  to  identify  the  relative  advantages  of  one  alterna¬ 
tive  over  another.  However,  like  the  economic  viability  and  investment  protection  surveillance  re¬ 
quirements  assessment  this  ranking  directly  depends  on  the  preferences  of  the  prospective  plant 
owner.  Therefore,  this  ranking  of  alternatives  (particularly  the  assessment  of  'maintainability') 
will  be  only  qualitatively  performed. 
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5.5  Summary 


The  design  resolution  methdology  described  above  and  presented  in  Figures  5-3  through  5-5 
systematically  and  methodically  incorporates  the  design  requirements,  goals,  and  objectives  into 
design  alternatives  which  are  then  assessed  against  the  specified  constraints.  The  output  from  the 
methodology  is  a  set  of  design  alternatives  which  are  ranked  according  to  economic  feasibility 
and  maintainability. 

The  methodology  presents  a  general  framework  of  factors  to  be  considered  when  resolving 
identified  maintenance-related  barriers  to  a  specified  operating  cycle  length.  A  nuclear  reactor 
plant  is  a  complex  group  of  diverse  systems  and  components.  The  methodology  is  therefore  gen¬ 
eral  enough  to  generate  design  alternatives  to  resolve  a  broad  spectrum  of  barriers,  yet  structured 
enough  to  focus  the  design  effort  on  the  important  factors  and  considerations. 

In  the  remaining  chapters,  the  methodology  is  applied  to  resolve  the  barriers  identified  in 
Chapter  3.  To  illustrate  application  of  the  methodology.  Chapter  7,  'Application  of  Resolution 
Methodology-Reactor  Vessel  Overpressure  Protection,'  will  explicitly  step  through  the  method¬ 
ology  flowchart  presented  in  Figures  5-3  through  5-5  (pages  73  through  75).  The  other  chapters 
present  only  a  summary  of  the  relevant  factors  and  the  methodology  output. 
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Figure  5-3:  Design  Resolution  Methdology  Flowchart  -  Synthesis  of  Requirements 
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Figure  5-4:  Design  Resolution  Methdology  Flowchart  -  Synthesis  of  Maintainability 


Figure  5-5:  Design  Resolution  Methdology  Flowchart  -  Synthesis  of  Constraints 
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Chapter  6 


Resolution  of  Identified  Barriers 

6.1  Introduction 

In  Chapter  3,  'Operating  Pressurized  Water  Reactor  Surveillance  Program/  the  maintenance 
related  barriers  preventing  an  operating  PWR  from  attaining  an  extended  operating  cycle  were 
presented.  This  chapter  addresses,  in  general  terms  and  within  the  context  of  the  IRIS  design,  the 
Category  C  surveillances  identified  by  the  MIT  Extended  Fuel  Cycle  Project  which  can  neither  be 
performed  on-line  nor  have  their  performance  intervals  extended  to  48  months.  Where  a  potential 
solution  is  readily  apparent,  it  is  presented.  Several  barriers  require  additional  design  effort  and 
are  discussed  separately  in  Chapters  7  through  11. 

Many  of  the  components  and  systems  identified  by  the  MIT  Extended  Fuel  Cycle  Project  re¬ 
quire  testing  and  maintenance  because  of  their  role  in  ensuring  safety.  Evaluation  of  these  com¬ 
ponents  and  systems  using  the  methodology  of  Chapter  5  assisted  in  the  conceptual  development 
of  a  passive  emergency  heat  removal  system  which  could  be  tested  at  power.  This  system  is  de¬ 
scribed  in  Section  6.3,  and  the  integrated  testing  and  coordinated  maintenance  which  it  enables 
is  described  in  Chapter  11,  'Application  of  Resolution  Methodology-Reduced  Power  Window 
Surveillances.' 


6.2  IRIS  Resolution  of  Identified  Surveillances  Requiring  Reduced  Power 
or  Plant  Shutdown 

6.2.1  IRIS  Resolution  of  Regulatory  Based  Surveillances  Requiring  Plant  Shutdown 

6.2.1.1  In-Service  Testing 

Reactor  Vessel  and  Primary  System  Component  Relief  Valve  Testing  Overpressure  protection 
for  the  IRIS  vessel  is  described  in  Chapter  7,  'Application  of  Resolution  Methodology-Reactor 
Vessel  Overpressure  Protection/ 

Operability  and  Engineered  Safeguards  Response  Time  Testing  Integrated  safety  system  time 
response  testing  will  be  required  in  IRIS.  The  conceptual  IRIS  passive  cooling  system  (Section  6.3, 
below)  is  designed  to  be  tested  on-line  (at  reduced  power)  for  100%  system  operability  demon¬ 
stration.  This  passive  cooling  system  is  similar  to  the  AP600  passive  cooling  loop,  but  is  connected 
to  the  secondary  loop  rather  than  the  primary  loop.  The  specified  testing  periodicity  for  AP600 
passive  safety  systems  is  off-line  every  two  years,  with  quarterly  operability  checks  deferred  to 
the  off-line  period.  With  an  on-line  testing  method  it  is  anticipated  that  the  quarterly  operability 
checks  will  not  be  deferrable.  Some  of  these  operability  checks,  however,  will  require  reduced 
power  and  are  thus  vmdesirable. 

An  integrated  testing  program  is  proposed  (Chapter  11,  Section  11.3)  that  performs  limited 
operability  testing  quarterly  and  complete  system  operability  testing  every  four  years.^  Quarterly 
assurances  (which  are  currently  deferred)  that  key  components  are  functional  reduce  the  uncer¬ 
tainty  that  the  system  will  perform  when  required.  This  strategy  of  more  frequent  limited  testing 
allows  a  longer  100%  system  operability  demonstration  performance  interval,  possibly  as  long  as 
eight  years. 

Safety  System  Valve  Operability  Checks  Valve  operability  checks  will  be  conducted  via  the 

comprehensive  safety  system  operability  testing  of  Chapter  11,  Section  11.3.  AP600  safety  sys- 

’The  IRIS  strategy  is  to  perform  more  thorough  quarterly  checks  (which  are  not  power  limiting)  and  defer  the  com¬ 
plete  system  operability  test  as  long  as  feasible.  However,  as  will  be  seen  in  Chapter  8,  'Application  of  Resolution 
Methodology-Steam  Generator  Tube  Inspection,'  steam  generator  tube  integrity  inspections  are  the  limiting  inspec¬ 
tions  which  make  deferral  of  the  complete  safety  system  operability  testing  longer  than  the  steam  generator  inspection 
interval  unnecessary. 


terns  have  a  limited  number  of  MOVs,  utilizing  air  operated  and  Squibb  (explosively  actuated) 
valves  where  MOVs  have  been  traditionally  been  used.  IRIS  will  also  apply  this  design  practice, 
minimizing  or  eliminating  the  use  of  safety  grade  motor  operated  valves. 

It  should  be  noted  that  during  the  regulatory  review  of  the  AP600  design,  a  new  regulatory 
category  was  created  for  non-safety  systems.  This  category.  Regulatory  Treatment  of  Non-Safety 
Systems  (RTNSS),  applies  regulatory  controls  to  non-safety  systems  which  are  used  preferentially 
to  safety  systems  when  available.  As  there  has  been  no  AP600  plant  built,  it  is  unclear  as  to  what 
the  ultimate  scope  of  the  RTNSS  program  will  be  and  how  it  will  impact  IRIS. 

6.2.1.2  Containment  Safety  Features  Response  Time  Testing 

The  IRIS  containment  design,  which  is  largely  borrowed  from  AP600,  allows  complete  on-line 
integrated  containment  safety  feature  operability  testing.  This  testing  will  be  integrated  into  the 
comprehensive  IRIS  passive  safety  systems  operability  testing  program  described  in  Chapter  11, 
Section  11.3. 

6.2.1.3  Steam  Generator  Eddy  Current  Testing 

Steam  generator  tube  integrity  inspection  is  described  in  Chapter  8,  'Application  of  Resolution 
Methodology-Steam  Generator  Tube  Inspection.' 

6.2.1.4  Emergency  Core  Cooling  Systems 

These  operability  tests  will  be  performed  on-line  (at  reduced  power)  by  the  integrated  100% 
passive  safety  system  operability  demonstration  of  Chapter  11,  Section  11.3. 

6.2.2  IRIS  Resolution  of  Nuclear  Steam  Supply  System  Investment  Protection  Surveil¬ 
lances  Requiring  Plant  Shutdown 

6.2.2.1  Component  Cooling  System  Relief  Valve  Testing 

Overpressure  protection  of  individual  components  in  the  component  cooling  system  will  be 
required  to  prevent  over-pressurizing  an  isolated  component  due  to  thermal  expansion.  These 


components  can  be  protected  by  having  a  thermal  relief  check  valve  in  parallel  with  the  down¬ 
stream  isolation  valve  to  ensure  that  isolated  component  pressure  never  exceeds  component  cool¬ 
ing  water  system  pressure.  This  thermal  relief  check  valve  arrangement  eliminates  the  need  for 
individual  component  relief  valves,  and  ensures  that  the  component  cannot  be  inadvertently  over¬ 
pressurized  if  it  is  isolated  from  the  component  cooling  water  system.  For  components  which 
are  connected  to  a  higher  pressure  source,  such  as  the  reactor  coolant  pump  stator  jacket,  the 
component  must  be  manually  isolable  from  the  higher  pressure  source  to  prevent  a  leak  into  the 
component  cooling  water  system  from  over-pressurizing  the  entire  system. 

6.Z.2.2  Chemical  and  Volume  Control  System  Relief  Valve  Testing 

This  particular  surveillance  is  eliminated  by  design.  Component  overpressure  protection  will 
be  provided  as  described  in  Section  6.2.2. 1. 

6.2.2.3  Reactor  Coolant  Pump  Lubricating  Oil 

These  surveillances  are  eliminated  by  design.  The  reactor  coolant  pumps  will  be  of  a  sealed 
motor  design  and  are  lubricated  by  primary  coolant. 

6.2.3  IRIS  Resolution  of  Balance  of  Plant  Investment  Protection  Surveillances  Requir¬ 
ing  Plant  Shutdown 

6.2.3.1  Auxiliary  Systems  Relief  Valve  Testing 

Component  overpressure  protection  will  be  provided  as  described  in  Section  6.2.2. 1. 

6.2.3.2  Condenser  Waterbox  Cleaning 

Condenser  waterbox  cleaning  is  described  in  Chapter  9,  'Application  of  Resolution  Methodology- 
Main  Condenser.' 

6.2.3.3  Main  Steam  Safety  Valve  Testing 

The  main  steam  safety  valves  are  ASME  Class  1  valves,  and  will  be  resolved  in  a  similar 
manner  to  reactor  vessel  overpressure  protection  (Chapter  7). 


6.2.4  IRIS  Resolution  of  Surveillances  Requiring  Reduced  Power  in  the  Extended 
Fuel  Cycle  Project 

Resolution  of  surveillances  requiring  reduced  power  are  described  in  Chapter  11,  'Application 
of  Resolution  Methodology-Reduced  Power  Window  Surveillances.' 

6.3  IRIS  Emergency  Heat  Removal  System 

Implicit  in  the  resolution  of  the  regulatory  based  surveillances  is  the  observation  that,  at  some 
point,  a  100%  demonstration  of  the  operability  of  all  safety  features  must  be  performed.  A  passive 
cooling  system  for  use  in  IRIS,  similar  to  the  AP600  passive  cooling  loop,  is  shown  in  Figure  6- 
1.  Four  loops  will  be  utilized,  with  each  loop's  heat  removal  capability  roughly  equal  to  one- 
third  of  the  total  heat  removal  burden.  This  allows  one  passive  cooling  loop  to  be  retired  in-place 
during  the  operating  cycle  if  necessary  due  to  either  failure  of  the  cooling  loop  or  failure  of  the 
corresponding  steam  generator. 

Each  passive  cooling  loop  consists  of  isolation  valves,  an  expansion  tank,  and  a  heat  exchanger. 
When  the  isolation  valves  are  opened,  natural  circulation  causes  water  to  be  forced  into  the  steam 
generator  through  the  feed  header.  The  cooling  water  is  heated  (or  boils)  and  flows,  due  to  the 
natural  circulation  head  developed,  back  to  the  heat  exchanger.  Heat  is  transferred  to  the  heat  ex¬ 
changer  tank,  which  is  vented  to  atmosphere  and  contains  sufficient  water  to  prevent  evaporation 
from  lowering  the  tank  water  level  to  the  tube  bundle.  The  steam  generator  water  addition  tank 
supplies  makeup  water  to  the  passive  cooling  loop  (which  will  be  necessary  as  the  bulk  water 
temperature  is  reduced)  to  prevent  loss  of  natural  circulation  head. 

The  strategy  for  testing  the  IRIS  passive  cooling  loops  is  presented  in  Chapter  11,  Section  11.3, 
'IRIS  Integrated  Testing  and  Coordinated  Maintenance.' 

6.4  Summary 

All  of  the  four  year  cycle  length  barriers  identified  by  the  MIT  Extended  Fuel  Cycle  Project 
have  been  addressed  in  the  context  of  IRIS.  Although  all  solutions  have  not  been  addressed  by 
detailed  design,  discussions  with  IRIS  design  engineers  indicate  that  the  problem  is  now  suffi- 
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dently  bounded  to  readily  and  efficiently  develop  viable  design  solutions.  The  only  cycle  length 
barriers  which  cannot  be  readily  solved  are:^ 

•  Primary  relief  valve  testing, 

•  Steam  generator  eddy  current  inspection, 

•  Condenser  waterbox  maintenance, 

•  Main  turbine  throttle  control  maintenance, 

•  Safety  system  testing,  and 

•  Reduce  power  window  items. 

These  items  are  discussed  in  the  following  chapters. 


^Note  that  rod  control  system  testing  also  presents  a  significant  operating  cycle  length  barrier.  However,  the  IRIS 
core  design  has  not  been  completely  specified  and  therefore  adequate  rod  control  system  requirements  cannot  yet  be 
specified. 
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Chapter  7 


Application  of  Resolution 
Methodology-Reactor  Vessel 
Overpressure  Protection 

7.1  Introduction 

This  chapter  discusses  the  impact  of  providing  overpressure  protection  on  the  IRIS  operating 
cycle  length  goal.  The  methodology  of  Chapter  5  will  be  explicitly  applied  to  demonstrate  it's 
applicability.  The  design  alternatives  proposed  were  not  generated  by  a  single  pass  through  the 
methodology  flowchart,  primarly  due  to  the  high  impact  of  regulatory  requirements  on  the  design. 
Therefore,  this  chapter  begins  with  a  discussion  of  the  regulatory  requirements  so  that  the  reader 
can  observe  this  impact  on  the  alternatives  generated. 

7.2  Regulatory  Requirements 

The  requirement  to  provide  system  overpressure  protection  is  given  by  the  American  Society 
of  Mechanical  Engineers  (ASME)  Boiler  and  Pressure  Vessel  Code,  hereafter  referred  to  as  the  Code. 
Section  III,  Division  1-NB,  Article  NB-7000  of  the  Code  provides  requirements  for  Class  1  com¬ 
ponents  with  similar  requirements  existing  under  the  Code  for  all  other  classes  of  components. 
Overpressure  protection  is  currently  provided  for  reactor  vessels  using  two  (or  more)  pressure 
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relief  valves.^ 

Pressure  relief  valve  testing  is  conducted  in  accordance  with  the  "Operations  and  Maintenance 
of  Nuclear  Power  Plants,  ASME/ANSI  (American  National  Standards  Institute),  OM-1987"  Chap¬ 
ter  1.  Under  OM-1987,  the  owner/ operator  has  the  option  of  testing  the  pressure  relief  valve  in- 
place  or  replacing  the  pressure  relief  valve  with  a  bench  tested  spare.  Most  plants  opt  to  replace 
the  pressure  relief  valve  with  a  bench  tested  spare  during  a  scheduled  outage  rather  than  test  in- 
place  because  it  places  the  individual  system  out  of  service  for  a  shorter  period  of  time.  In  general, 
the  time  required  for  testing  (setup,  conducting  the  test,  and  restoring  the  system)  is  comparable 
to  the  time  required  for  pressure  relief  valve  replacement  (setup,  valve  removal,  valve  installation, 
and  restoring  the  system).  However,  using  the  bench  tested  spare  (which  has  already  passed  it's 
lift  test)  removes  any  scheduling  uncertainty  associated  with  the  repair  or  replacement  of  a  pres¬ 
sure  relief  valve  which  fails  it's  in-place  test.  Currently,  all  pressure  relief  valve  testing  on  active 
systems  (those  required  to  be  active  when  the  reactor  is  on-line,  such  as  pressurizer  relief  valves) 
is  conducted  with  the  reactor  shutdown. 

The  operation  of  a  pressure  relief  valve  is  characterized  by  the  Code  using  three  parameters: 
set,  lift,  and  blowdown.  Set  is  the  set  pressure  at  which  the  pressure  relief  valve  begins  to  open. 
The  Code  specifies  a  set  pressure  tolerance  based  on  operating  system  pressure,  and  for  typical 
PWR  conditions  (including  IRIS)  the  tolerance  is  ±3%.  Lift  pressvure  is  the  pressure  at  which  the 
pressure  relief  valve  is  fully  open,  and  rated  relief  capacity  is  attained.  The  Code  specifies  that 
pressure  relief  valves  shall  attain  rated  lift  at  a  pressure  which  does  not  exceed  the  set  pressure  by 
more  than  10%.  Blowdown  is  the  pressure  at  which  the  pressure  relief  valve  fully  reseats.  The  Code 
does  not  specify  a  value  for  blowdown.  Rather,  the  Code  requires  the  blowdown  not  to  exceed  that 

’The  following  definitions  are  provided  from  Section  III,  Division  1-NB,  Article  NB-7000  of  the  Code: 

•  A  pressure  relief  valve  is  a  pressure  relief  device  which  is  designed  to  reclose  and  prevent  the  further  flow  of  fluid 
after  normal  conditions  have  been  restored. 

•  A  safety  valve  is  a  pressure  relief  valve  actuated  by  irJet  static  pressure  and  characterized  by  rapid  opening  or 
pop  action. 

•  A  safety  relief  valve  is  a  pressure  relief  valve  characterized  by  rapid  opening  pop  action,  or  by  opening  generally 
proportional  to  the  increase  in  pressure  over  the  opening  pressure. 

•  A  relief  valve  is  a  pressure  relief  valve  actuated  by  inlet  static  pressure  and  having  a  gradual  lift  generally  pro¬ 
portional  to  the  increase  in  pressure  over  opening  pressure. 

•  A  pressure  relief  device  is  designed  to  open  to  prevent  a  rise  of  internal  fluid  pressure,  greater  than  a  specified 
value,  resulting  from  exposure  to  pressure  transient  conditions.  It  may  be  a  pressure  relief  valve  or  a  nonreclos¬ 
ing  pressure  relief  device. 
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value  which  the  designer  has  determined  (and  specified  in  the  Overpressure  Protection  Report)  to 
be  the  minimum  reseat  pressure. 

ASME/ANSI,  OM-1987  requires  that  all  Class  1  Pressure  Relief  Devices  (which  includes  the 
pressurizer  relief  valves)  be  tested: 

•  Prior  to  initial  installation. 

•  Within  the  initial  5  year  operating  period  according  to  the  following  schedule: 


Minimum  Cumulative  % 
of  Valves  of  Each  Type  and 
Time  Period  Manufacture  to  Be  Tested 


Startup 

— 12  months 

0 

13  months 

—  24  months 

25 

25  months 

—  36  months 

50 

37  months 

—  48  months 

75 

49  moi'.ths 

—  60  months 

100 

Additionally,  a  minimum  of  20%  of  the  valves  of  each  type  and  manufacture  shall  be  tested 
within  any  24  months.  This  20%  shall  be  previously  imtested  valves,  if  they  exist. 

•  During  subsequent  5  year  periods  such  that  all  valves  of  each  type  and  manufacture  shall  be 
tested  with  a  minimum  of  20%  of  the  valves  tested  within  any  24  months.  This  20%  shall  be 
previously  untested  valves,  if  they  exist. 

7.2.1  Eliminating  the  Need  for  Overpressure  Protection  by  Design 

Section  NB-7110  of  the  Code,  "General  Requirements:  Scope"  specifies  that  "a  system  shall 
be  protected  from  the  consequences  arising  from  the  application  of  conditions  of  pressure  and 
coincident  temperature  that  would  cause  either  the  Design  Pressure  or  the  Service  Limits  specified 
in  the  Design  Specification  to  be  exceeded."  Specifically  excluded  from  the  scope  of  the  Article  are 
the  effects  of  extremely  short  duration  pressure  increases  (such  as  water  hammer)  and  the  design 
of  reactor  shutdown  systems. 

Within  NB-7110,  there  exists  the  possibility  that  a  system  could  be  designed  that  would  not 
be  subject  to  conditions  which  lead  to  exceeding  either  the  Design  Pressure  or  the  Service  Limits 
specified  in  the  Design  Specifications.  The  IRIS  design  is  a  large  integral  reactor  vessel  with  a  large 
steam  space,  and  design  solutions  could  be  sought  which  meet  the  Code  requirements.  However, 
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it  is  unlikely  that  a  nuclear  power  plant  could  be  designed  in  this  manner  since  the  energy  stored 
in  the  fuel  can,  imder  certain  conditions,  be  released  in  a  rapid  enough  manner  as  to  cause  an 
unacceptably  high  peak  pressure.  Other  plausible  conditions,  such  as  a  sudden  loss  of  steam 
demand,  can  create  a  rapidly  rising  pressure  condition  which  may  require  intervention  to  prevent 
exceeding  the  Design  Pressure  or  Service  Limits. 

Acknowledgement  of  the  need  for  overpressure  protection  in  accordance  with  the  Code,  then, 
requires  compliance  with  the  Code.  As  written.  Article  NB-7000  is  almost  entirely  devoted  to 
pressm-e  relief  valves.  Within  the  category  of  pressure  relief  devices  required  by  the  code  are  both 
pressure  relief  valves  and  nonreclosing  pressure  relief  devices.  Within  nonreclosing  pressure  re¬ 
lief  devices,  rupture  disk  devices  are  the  only  devices  addressed.  However,  rupture  disk  devices 
are  not  permitted  to  be  used  as  the  sole  pressure  relief  device.  It  appears,  then,  that  the  intent  of 
the  Code  is  to  ensure  that  a  pressure  relief  valve  is  used  in  the  overpressure  protection  scheme. 
Therefore,  the  opinion  of  the  IRIS  design  team  is  that  amount  of  effort  required  for  the  develop¬ 
ment,  testing,  and  validation  of  a  pressure  self-mitigating  vessel  would  be  better  spent  seeking 
other  (less  revolutionary)  design  solutions. 

7.3  Synthesis  of  Requirements 

7.3.1  Functional  Requirements 

To  protect  the  reactor  vessel  and  attached  piping  from  potential  overpressure  conditions  (which 
could  ultimately  lead  to  catastrophic  failure),  overpressure  protection  is  required.  The  capacity  of 
the  overpressure  protection  device  must  be  great  enough  to  arrest  the  design  basis  pressure  rise 
and  ensure  that  the  design  maximum  pressure  is  not  exceeded.  For  the  IRIS  design  resolution 
we  seek,  the  overpressure  protection  device  must  either  be  maintainable  on-line  or  not  require 
maintenance  for  the  entire  eight  year  operating  cycle. 

7.3.2  Currently  Used  Component  —  Pressurizer  Relief  Valve 

All  currently  operating  PWR  plants  use  a  pressurizer,  located  above  the  reactor  vessel  eleva¬ 
tion  and  typically  connected  to  one  of  the  reactor  coolant  cold  legs,  to  maintain  reactor  coolant 
system  pressure.  The  pressurizer  is  a  heated  vessel  that  acts  as  a  head  tank  or  surge  volume  to 
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mitigate  system  pressure  transients.  Overpressure  protection  for  the  reactor  coolant  system  is  pro¬ 
vided  by  two  or  more  relief  valves  directly  connected  to  the  pressurizer  steam  space.  The  reason 
for  using  a  steam  relief  valve  (vice  a  water  relief  valve)  is  two-fold:  (1)  less  mass  is  lost  from  the 
system  for  a  given  pressure  reduction  upon  actuation,  and  (2)  there  is  less  chance  of  fouling  the 
valve  seat  (by  corrosion  products)  during  reseating. 

Does  existing  component  meet  requirements?  Based  on  the  experience  at  the  candidate  oper¬ 
ating  PWR,  as  well  as  limited  interviews  with  personnel  at  other  plants,  the  relief  valves  in  service 
today  are  tmlikely  to  operate  reliably  for  the  entire  IRIS  cycle  length.  The  pressurizer  relief  valve 
meets  the  IRIS  overpressure  protection  functional  requirements  but,  based  on  the  above  regula¬ 
tory  testing  requirements,  cannot  meet  the  IRIS  cycle  length  objective.  To  conduct  pressurizer 
relief  valve  testing  with  the  reactor  at  power  requires  either  of  the  following: 

•  the  capability  to  isolate  and  remove  the  valve  from  the  system  for  bench  testing, 

•  the  capability  to  test  the  valve  in-place  (either  isolated  or  unisolated  from  the  primary  sys¬ 
tem),  or 

•  testing  the  unisolated  valve  in-place  by  raising  system  pressure  to  the  valve  lift  point. 

Employment  of  any  of  these  methods  is  likely  to  require  submittal  of  a  Code  case  to  the  ASME, 
since  these  methods  are  not  explicitly  permitted  by  the  code.  However,  Article  NB— 7142  does 
specify  requirements  to  be  met  if  an  isolation  valve  is  to  be  utilized  and  hence  a  solution  may  be 
found  that  is  within  the  scope  of  the  current  Code. 

7.3.3  Component  Modification 

Can  existing  component  be  modified  to  meet  requirements?  There  are  modifications  which 
can  be  made  to  the  pressurizer  relief  valve  to  allow  for  on-line  testing.  Potential  modifications  are 
described  below. 

7.3.3.1  Spring-Loaded  Relief  Valve 

The  spring-loaded  relief  valve,  shown  in  Figure  7-1  (a),  is  the  most  commonly  used  overpres¬ 
sure  protection  device.  An  unmodified  spring-loaded  relief  valve  meets  the  functional  require¬ 
ments  to  provide  overpressure  protection  for  the  reactor  vessel  but  cannot  meet  the  IRIS  eight 
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year  cycle  length  objective  due  to  the  regulatory  requirements  which  specify  more  frequent  test¬ 
ing  (Section  7.2).  The  design  issue  to  resolve  is  whether  the  relief  valve  can  be  taken  out  of  service 
for  on-line  testing.  Based  on  the  safety  role  that  the  valve  performs,  overpressure  protection  can¬ 
not  be  suspended  even  for  short  time  periods.  Therefore,  a  method  to  test  relief  valves  while 
maintaining  reactor  vessel  overpressure  protection  must  be  utilized. 

7.3.3.1.1  On-line  Spring-Loaded  Relief  Valve  Testing  Several  Engineering  Services  compa¬ 
nies^  provide  on-line  testing  of  simple  spring-loaded  safety  and  relief  valves  under  normal  op¬ 
erating  pressure  and  temperature.  It  is  primarily  utilized  in  the  nuclear  industry  for  shutdown 
in-place  testing  of  main  steam  safety  valves  where  it  is  not  feasible  (due  to  time  and  expense)  to 
remove  the  valve  from  the  system,  and  full  test  pressure  cannot  be  obtained  to  lift  the  valve.  In- 
place  assisted  lift  testing  is  limited  to  those  applications  where  the  valve  is  accessible  for  testing, 
the  valve  outlet  can  be  monitored  for  leakage,  and  a  lift  assist  device  with  reduced  system  pres¬ 
sure  can  be  used  to  actuate  the  valve  (since  system  pressure  can  not  be  used  to  achieve  the  set 
pressure  of  the  valve).  Assisted  lift  testing  is  currently  only  practical  for  valves  in  systems  with 
highly  compressible  media,  such  as  gas  or  steam.  This  method  is  not  currently  used  to  test  water 
valves  since  the  outlet  of  the  valve  usually  cannot  be  observed  for  flow  and  determination  of  valve 
set  and  lift  to  the  required  accuracy  is  not  possible. 

Using  the  simplifed  spring-loaded  relief  valve  drawing  of  Figure  7-1,  assisted  lift  testing  is 
conducted  according  to  the  following  (simplified)  procedure.  First,  the  valve  set  pressure  and 
current  system  pressure  are  compared  to  determine  the  expected  pressure  difference.  Using  valve 
nameplate  data,  this  pressure  is  converted  to  a  force  (pull)  and  the  appropriate  range  load  cell  is 
selected  and  calibrated.  The  valve  cap  is  removed,  and  the  lifting  mechanism  (with  load  cell)  is 
attached  to  the  valve  stem.  Flow  sensors,  which  allow  detection  of  the  valve  set,  lift,  and  blow¬ 
down,  are  attached  to  the  discharge  piping  near  the  valve  body.  While  monitoring  the  discharge 
piping  for  flow,  the  lift  mechanism  pulls  the  disk  (via  the  valve  stem)  against  the  valve  spring 
until  set  is  detected.  Once  set  is  determined,  the  lift  mechanism  opens  the  valve  further  until  full 
flow  (lift)  is  detected.  Finally,  the  valve  is  unloaded  and  blowdown  is  measured.  Again  using  the 
valve  nameplate  data,  the  measured  forces  are  converted  to  pressures  and  added  to  the  measured 
^For  example,  Furmanite. 
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(a)  Simplified  Spring-Loaded  (b)  Simplified  Assisted  Lift 

Relief  Valve  Test  Setup 

Figure  7-1:  Assisted  Lift  Relief  Valve  Testing  —  Simplified  Drawing 


system  pressure  to  determine  the  valve  set,  lift,  and  blowdown. 

Assisted  lift  testing  has  two  distinct  advantages.  First,  since  the  testing  is  conducted  at  an  ac¬ 
tual  system  pressure  less  than  the  set  pressure  there  is  a  large  differential  pressure  across  the  valve 
disk  once  the  lift  mechanism  releases  the  valve  stem.  This  ensures  that  the  valve  disk  reseats 
quickly  and  positively,  without  the  valve  chatter  normally  experienced  when  the  applied  pressure 
approaches  the  blowdown  pressure.  Second,  the  lift  mechanism  can  force  the  valve  closed  if  the 
valve  sticks  open  after  the  valve  stem  is  released  by  the  lift  mechanism.  Although  assisted  lift 
testing  of  pressurizer  relief  valves  has  never  been  conducted  at  power,  these  advantages  could 
mitigate  the  risk  of  excessive  coolant  loss  for  a  stuck  open  relief  valve.  For  IRIS,  the  relief  valves 
would  either  need  to  be  made  accessible  (so  personnel  could  connect  the  lift  mechanism)  or  re¬ 
designed  to  incorporate  the  lift  mechanism  in  the  valve.  Even  if  the  lift  mechanism  is  permanently 


installed,  the  process  cannot  be  completely  automated  since  calibration  of  the  lift  mechanism  load 
cell  is  required  prior  to  testing. 

At  least  one  additional  relief  valve  should  be  installed  in  excess  of  the  number  specified  in  the 
Overpressure  Protection  Report  to  eliminate  the  potential  need  to  conduct  relief  valve  setpoint 
adjustments  at  power.  If  a  single  relief  valve  is  found  to  be  out-of-specification,  then  it  can  be 
gagged  shut  and  operation  can  continue^  with  the  minimum  number  of  relief  valves  specified  in 
the  Overpressure  Protection  Report. 

7.3.3.2  Pilot  Operated  Relief  Valve 

A  pilot  operated  relief  valve  (Figure  7-2)  is  a  compound  valve  which  uses  a  small  pilot  valve 
to  direct  high  pressure  system  fluid  to  the  operating  piston  of  a  large  main  valve.  When  the  pilot 
valve  opens  and  the  underside  of  the  operating  piston  is  pressurized,  the  main  valve  spring  is 
compressed  allowing  fluid  flow  through  the  main  valve.  The  operation  of  the  pilot  valve  is  sim¬ 
ilar  to  the  spring-loaded  relief  valve,  but  typically  uses  a  corrugated  bellows  instead  of  a  spring. 
When  system  pressure  is  reduced  and  the  pilot  valve  closes,  the  high  pressure  in  the  main  valve 
operating  cylinder  bleeds  off  allowing  the  main  valve  spring  to  force  the  main  valve  closed.  The 
primary  advantage  of  the  pilot  operated  relief  valve  is  that,  unlike  the  spring-loaded  relief  valve, 
the  main  valve  is  not  subject  to  near-zero  differential  pressure.  Therefore,  a  large  differential  pres¬ 
sure  always  exists  to  rapidly  close  and  seat  the  main  valve.  Testing  of  a  pilot  operated  relief  valve 
consists  of  determining  the  pilot  valve  operating  characteristics  and  verifying  that  the  main  valve 
is  not  physically  bound. 

The  pilot  operated  relief  valve  could  be  configured  using  redundancy  as  discussed  in  Sec¬ 
tion  7.4.1.1  above.  For  this  arrangement,  both  the  pilot  sensing  line  and  main  valve  inlet  line 
would  be  isolated  from  the  system  for  testing.  This  permits  both  determination  of  the  pilot  valve 
operating  characteristics  and  manually  exercising  the  main  valve  stem. 

®OM-1987  has  specific  requirements  for  bench-tested  relief  valves  which  are  found  to  be  out-of-specification,  but  not 
for  on-line  tested  valves.  It  does  specify  that  the  valve  shall  be  repaired /replaced,  the  cause  of  failure  shall  be  deter¬ 
mined  and  corrected,  and  the  valve  shall  be  satisfactorily  retested  prior  to  returning  to  service.  For  this  configuration, 
with  valve(s)  installed  in  excess  of  the  requirement,  the  out-of-specification  valve  will  not  be  returned  to  service  until 
the  next  operating  cycle.  However,  the  cause  of  failure  will  need  to  be  determined  to  ensure  that  a  common-cause 
failure  will  not  disable  all  overpressure  protection. 


7.3.3.3  Improved  Relief  Valve 


The  primary  limitation  of  cixrrent  pressure  relief  valves  (whether  simple  spring-loaded  or  pilot 
valve  actuated)  is  setpoint  drift.  Current  pressure  relief  valves  operate  by  generating  a  force  to 
compress  a  spring  and  lift  the  main  disk  off  it's  shut  seat.  Changes  in  material  properties,  corrosion 
buildup,  and  thermal  effects  all  contribute  to  changes  in  valve  actuation  characteristics.  Only 
through  material  advances  can  these  deficiencies  be  corrected.  However,  since  the  industry  does 
not  have  a  need  for  these  advanced  relief  valves  there  is  no  industry  impetus  to  invest  in  the 
research  and  development  necessary  to  field  a  relief  valve  which  overcomes  these  limitations. 

7.3.3.4  Summary  of  Modifications 

Only  two  relief  valve  modifications  are  possible  to  meet  the  IRIS  operating  cycle  length  re¬ 
quirements:  modification  to  allow  on-line  testing  and  modification  to  eliminate  the  need  for  test¬ 
ing.  The  first  is  most  feasibly  met  through  a  modification  which  integrates  an  assisted  lift  mecha¬ 
nism  into  the  valve  (See  Section  7.3.3.1.1).  The  second  requires  advances  in  materials  technology 
to  address  the  limitations  that  led  to  the  current  regulatory  specified  testing  periodicity. 

7.4  Synthesis  of  Maintainability 

7.4.1  On-Line  Maintenance 

Can  component  be  maintained  on-line?  Yes,  utilizing  the  assisted-lift  device  of  Figure  7-1. 

System  pressure,  without  assisted-lift,  could  be  used  to  conduct  relief  valve  testing.  The  Code 
requires  an  Overpressure  Protection  Report  which  describes  the  design  basis  pressure  transient 
upon  which  the  total  relief  capacity  and  setpoint  is  based.  If  system  pressure  is  to  be  used  for  in- 
place  relief  valve  testing,  then  the  lift  pressure  (instead  of  normal  system  pressure)  now  becomes 
the  starting  pressure  onto  which  is  added  the  design  basis  pressure  transient.  This  results  in  a 
lower  relief  valve  setpoint  which  provides  an  insufficient  to  prevent  inadvertent  lifting  during 
normal  operating  transients.  Additionally,  inadvertent  depressurization  becomes  a  greater  risk  if 
the  relief  valve  fails  to  reseat.  Using  system  pressure  for  relief  valve  testing,  therefore,  should  only 
be  considered  if  no  other  on-line  testing  method  can  be  developed. 
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7.4.1.1  Installing  Redundancy  to  Permit  or  Defer  Testing 

Can  redundancy  be  utilized  to  allow  for  maintenance?  Although  neither  the  ASME  Code  nor 
OM-1987  requires  the  reactor  to  be  shutdown  during  relief  valve  testing,  the  rules  do  not  explicitly 
permit  isolation  valves  to  be  installed  in  the  path  of  the  relief  valve.  To  the  contrary,  NB-7142  of 
the  Code  prohibits  stop  valve  installation  unless  "such  stop  valves  are  constructed  and  installed 
with  controls  and  interlocks  so  that  the  requirements  of  NB-7300  are  met  under  all  conditions  of 
operation  of  both  the  system  and  the  stop  valves." 

Section  NB-7300  of  the  Code  addresses  the  required  relieving  capacity  of  installed  pressure 
relief  devices,  which  includes  consideration  of  all  relevant  design  and  operating  factors  which 
may  contribute  to  an  overpressure  condition. 

Figure  7-3  shows  an  arrangement  which  could  meet  the  Code  requirements  while  providing 
adequate  isolation  to  conduct,  via  a  test  fitting,  in-place  testing.  The  key  to  this  arrangement  is  the 
three-way  valve  which  cannot  simultaneously  isolate  both  relief  valves  from  the  reactor  vessel, 
even  if  the  valve  is  inadvertently  placed  in  a  mid-position.  The  internal  flow  path  is  shown  in 
Figure  7-4.  Only  when  the  valve  is  correctly  aligned  to  one  relief  valve  is  the  other  isolated.  To 
meet  the  Code  requirements  both  valves  must  either  be  operational  (since  it  is  possible  that  an 
inoperable  relief  valve  may  be  placed  in  service)  or  the  valve  physically  prevented  (via  interlocks) 
from  aligning  the  reactor  vessel  to  an  inoperable  relief  valve. 

With  the  addition  of  suitable  interlocks,  the  arrangement  of  Figure  7-3  can  be  used  to  allow  the 
second  relief  valve  to  act  as  an  installed  spare.  Since  there  is  no  regulatory  prescribed  shelf-life  for 
a  tested  relief  valve  that  is  not  in  service,  the  second  valve  can  remain  isolated  from  the  reactor 
vessel  until  the  first  valve  requires  testing.  Then,  rather  than  testing  the  first  valve,  it  is  isolated 
and  the  second  valve  is  placed  in  service.  Suitable  interlocks  could  consist  of  a  stem  locking  device 
or  weld.  However,  as  with  the  three-way  valve  design  a  Code  case  will  likely  need  to  be  submitted 
to  ASME  for  evaluation. 

Can  the  component  be  isolated  for  maintenance?  Yes,  utilizing  the  arrangement  of  Figure  7- 
3.  If  the  system  is  a  high  energy  system,  as  is  the  case  for  the  primary  coolant  system,  then  two 
upstream  isolation  valves  and  one  downstream  isolation  valve  (if  the  potential  exists  for  reverse 
flow  in  the  downstream  piping  from  another  source)  are  required  for  personnel  safety. 

Isolation  (or,  in  the  nomenclature  of  the  Code,  stop)  valves  are  not  specifically  prohibited  by 


Retention  Tank 

Figure  7-3:  Redundant  Spring-Loaded  Relief  Valves  with  ASME  Boiler  and  Pressure  Vessel  Code 
Compliant  Isolation 
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from  reactor  vessel 


from  reactor  vessel 


(a)  Aligned  to  both  relief  valves  (b)  Aligned  to  one  relief  valve 

Figure  7-4:  ASME  Boiler  and  Pressure  Vessel  Code  Compliant  Isolation  Valve  Flow  Path.  In  (a), 
flow  is  directed  to  both  relief  valves.  In  (b),  flow  is  directed  only  to  one  relief  valve  with  the  other 
isolated  for  in-place  testing.  Angular  travel  of  the  valve  ball  is  mechanically  limited  to  prevent 
simultaneously  isolating  both  relief  valves  from  the  reactor  vessel. 


the  Code.  Rather,  specification  is  made  that  these  stop  valves  shall  be  constructed  such  that  dur¬ 
ing  normal  operation  the  pressure  relief  device  cannot  be  rendered  inoperable.  This,  however,  is 
exactly  what  is  intended  by  the  isolation  valve  described  in  Section  7.4.1. 1.  But,  the  isolation  valve 
has  two  relief  valves  attached  and  one  is  always  on  service.  Therefore,  the  intent  of  the  Code  is 
met  since  the  isolation  valve  cannot  isolate  both  relief  valves  simultaneously  and  the  subsystem 
consisting  of  one  isolation  valve  and  two  relief  valves  is  considered  a  single  pressure  relief  device. 

Can  component  be  made  accessible  at  power?  Yes,  based  on  the  low  anticipated  dose  rate  (en¬ 
abled  by  the  large  vessel  annulus  and  shield  plates)  inside  the  containment  vessel  during  normal 
operation. 


7.5  Synthesis  of  Constraints 

Whether  by  assisted-lift  testing  or  utilization  of  an  isolation  valve  and  redundancy,  accessi¬ 
bility  for  testing  is  made  possible  by  the  low  anticipated  dose  rate  inside  the  containment  vessel. 
Failure  to  provide  overpressure  protection  for  the  reactor  vessel  is  an  unacceptable  risk,  and  so 
investment  protection  concerns  dictate  that  the  testing  frequency  should  be  at  least  as  frequent  as 


the  regulatory  requirement.  However,  the  regulatory  specified  frequency  is  based  on  a  significant 
amount  of  performance  history,  so  the  investment  protection  testing  frequency  is  likely  to  not  be 
more  frequent.  Therefore,  the  testing  frequency  of  OM-1987  (and  not  more  frequently)  should  be 
adopted  for  IRIS. 

Does  design  meet  operating  cycle  length  requirements?  The  methods  described  enable  the 
target  operating  cycle  length  of  eight  years  by  providing  a  means  for  conducting  testing  with  the 
reactor  at  power. 

Have  all  feasible  design  alternatives  been  generated?  Creative  design  can  continue  to  de¬ 
velop  alternatives,  but  these  are  likely  to  be  more  complex  and  require  accepting  a  higher  technical 
risk. 

7.6  Summary 

This  chapter  has  demonstrated  the  resolution  methodology  and  presented  several  alternatives, 
for  consideration  in  the  IRIS  design,  which  meet  the  eight  year  operating  cycle  length  objective. 
The  first  two,  assisted  lift  testing  and  installation  of  redundancy,  utilize  a  current  technology  relief 
valve  and  conduct  testing  on-line  and  at  power.  The  third  alternative  is  to  develop  an  improved 
relief  valve  that  will  perform  satisfactorily  for  the  entire  IRIS  operating  cycle.  The  last  alternative 
is  to  design  IRIS  to  be  pressure  self-mitigating,  and  thus  a  pressure  relief  device  would  not  be 
required. 

Table  7.1  summarizes  the  alternatives  qualitatively  ranked  by  maintainability,  economic  viabil¬ 
ity,  and  technology  risk.  For  the  four-year  IRIS  maintenance  cycle  one  additional  alternative  exists, 
regulatory  change,  but  is  not  included  here  since  the  objective  is  to  design  systems  which  can  be 
maintained  at  power  allowing  much  longer  operating  cycles.  Within  the  alternatives  generated, 
installation  of  redundancy  presents  the  most  feasible  and  cost  effective  solution. 


Table  7.1:  Overpressure  Protection  Alternatives  Summary 


V  V  Alternative 

Report 

Section 

Maintain¬ 

ability 

Anticipated 

Cost 

Techribldgy 

Risk 

Assisted  lift  testing  of  current  technol¬ 
ogy  relief  valve 

7.3.3.1.1 

medium 

medium 

low 

Install  redundancy  and  a  code  compli¬ 
ant  isolation  valve  to  permit  in-place 
testing  of  isolated  relief  valve® 

7.4.1. 1 

medium 

low 

low 

Utilize  installed  spares  and  a  code 
compliant  isolation  valve  to  allow  de¬ 
ferral  of  testing 

7.4.1.1 

high 

medium 

medium 

Design  advanced  relief  valve  which 
does  not  require  maintenance  during 
the  operating  cycle 

7.3.3.3 

high 

medium 

high 

Design  reactor  vessel  system  such  that 
overpressure  protection  device  is  not 
required 

7.2.1 

high 

high 

high 

“Recommended  alternative  for  use  in  IRIS. 
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Chapter  8 


Application  of  Resolution 
Methodology-Steam  Generator  Tube 
Inspection 


8.1  Introduction 

Steam  generator  tubing  constitutes  a  significant  portion  of  the  reactor  coolant  pressure  bormd- 
ary  (RCPB).  The  design  of  the  RCPB  for  structural  and  leakage  integrity  is  addressed  in  either 
Title  10  of  the  Code  of  Federal  Regulations  (CFR),  Part  50  (10  CFR  Part  50),  Appendix  A  or  the 
licensing  basis  of  a  facility.  The  General  Design  Criteria  (GDC)  of  Appendix  A  state  that  the  RCPB 
shall  "have  an  extremely  low  probability  of  abnormal  leakage"  (GDC  14),  "shall  be  designed  with 
sufficient  margin  to  assure  that  the  design  conditions  of  the  reactor  coolant  pressure  boundary 
are  not  exceeded  during  any  condition  of  normal  operation"  (GDC  15),  and  "shall  be  designed  to 
permit  periodic  inspection  and  testing  of  important  areas  and  features  to  assess  their  structural 
and  leaktight  integrity"  (GDC  32). 
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The  first  two  requirements  will  not  be  explicitly  considered  here,  but  certamly  must  be  met 
by  any  steam  generator  design.  IRIS  is  considering  a  modular  helical-coildesign  (eight  modules 
arranged  in  the  reactor  vessel  annulus)  with  u-tube  configuration  as  the  backup  design.^  Regard¬ 
less  of  the  configuration,  the  steam  generator  will  have  inlet  and  outlet  channel  heads  (or  a  single 
inlet/outlet  head)  which  are  moimted  to  the  reactor  vessel  for  accessibility  to  meet  the  third  re¬ 
quirement.  This  arrangement  will  allow  access  to  the  steam  generator  from  the  secondary  side 
either  through  a  manway  or  by  removal  of  the  entire  channel  head  cover  plate.  Figure  8-1  shows 
the  IRIS  reactor  vessel  design  with  straight-tubed  steam  generators.  The  proposed  moimting 
method  is  the  same  for  all  steam  generator  design  types. 

Gaining  access  to  the  steam  generator  tubes  is  not  a  significant  design  obstacle.  The  design 
challenge  is  to  create  a  steam  generator  which  can  be  inspected  at  power,  and  ideally  while  in 
service.  This  chapter  investigates  this  design  challenge  and  potential  solutions. 

8.2  Requirements 

The  structural  and  leakage  integrity  of  steam  generator  tubing  is  maintained  through  sev¬ 
eral  defense-in-depth  measures,  including  in-service  inspection,  tube  repair  criteria,  primary-to- 
secondary  leak  rate  monitoring,  water  chemistry  control,  operator  training,  and  analyses  to  ensure 
that  safety  objectives  are  met.  The  degraded  tubes  must  be  removed  from  service  (by  plugging) 
or  repaired  if  detected  indications  (flaws)  exceed  40  percent  of  the  nominal  tube  wall  thickness 
as  required  in  plant  technical  specifications.  The  indications  are  detected  by  periodic  inspections 
using  qualified  nondestructive  testing  as  required  by  Criterion  IX  in  Appendix  B  to  10  CFR  Part 
50.  Eddy  current  technology,  one  method  of  nondestructive  testing,  is  the  primary  means  used  by 
the  industry  to  assess  the  condition  of  steam  generator  tubing. 

The  eddy  current  inspection  technique  correlates  the  depth  and  length  of  an  indication  to  sig¬ 
nal  responses  received  by  probes  passing  through  the  inside  of  the  tube.  Although  the  eddy  cur¬ 
rent  method  is  a  proven  technique  for  detecting  the  length  of  indications,  there  has  been  lim- 

hn  April  2001,  the  IRIS  team  evaluated  several  steam  generator  options  (u-tube,  c-tube,  helical-coil,  modular  helical- 
coil,  and  straight-tube)  and  selected  the  modular  helical-coil  design  as  the  primary  design  and  the  u-tube  design  as  the 
backup  design.  Where  IRIS  is  exploring  innovative  technologies  which  have  not  previously  been  used  for  pressur¬ 
ized  water  reactor  application,  such  as  the  modular  helical-tube  steam  generator,  the  technology  risk  is  mitigated  by 
concurrently  developing  a  backup  design  which  is  based  on  current  technology. 
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ited  success  in  demonstrating  its  capability  to  accurately  measure  the  depth  of  certain  types  of 
steam  generator  tube  indications.  Specifically,  indications  caused  by  intergranular  attack  (IGA) 
and  stress-corrosion  cracking  are  difficult  to  size  with  eddy  current  techniques  because  of  a  num¬ 
ber  of  complicating  variables,  such  as  oxide  deposits,  material  properties  and  geometry,  crack 
morphology,  human  factors,  data  analysis,  and  data  acquisition  practices.  In  one  recent  instance, 
a  licensee  sized  the  depths  of  IGA  indications  and  removed  from  service  those  tubes  with  IGA 
indications  exceeding  the  40  percent  through-wall  repair  limit.  Data  from  subsequent  destructive 
examinations  of  several  degraded  tube  specimens  removed  from  the  licensee's  steam  generators 
during  the  outage  indicated  that  the  estimated  through-wall  extent  of  degradation  in  these  speci¬ 
mens,  based  on  eddy  current,  was  significantly  less  than  the  true  depth  of  the  IGA  indications.^ 

In  order  to  successfully  disposition  steam  generator  tube  degradation  in  accordance  with  the 
repair  limits  in  the  technical  specifications  and  Appendix  B  to  10  CFR  Part  50,  the  inspection  pro¬ 
cess  must  be  capable  of  (1)  detecting  indications  of  tube  degradation,  (2)  characterizing  the  indica¬ 
tions,  e.g.,  cracklike,  IGA,  manufacturing  burnish  mark,  or  wear  and  the  orientation  for  cracklike 
degradation,  and  (3)  accurately  sizing  the  depth  of  degradation.  The  term  "inspection  process" 
refers  to  the  use  of  one  or  a  combination  of  nondestructive  inspection  techniques  to  evaluate  a 
specific  mode  of  steam  generator  tube  degradation.  This  evaluation  could  potentially  include 
three  inspection  methods  (e.g.,  eddy  current  probes)-one  for  detection,  one  for  characterization, 
and  a  third  to  size  the  indication.  However,  the  successful  qualification  of  the  inspection  pro¬ 
cess  requires  a  qualification  of  each  method  (i.e.,  probes,  cables,  software,  etc.)  for  the  mode  of 
degradation  being  evaluated  in  the  steam  generator  tube  examinations.  Experience  has  demon¬ 
strated  that  for  effective  qualification  the  data  set  demonstrating  the  capability  of  the  inspection 
process  should  consist,  to  the  extent  practical,  of  service-degraded  tube  specimens  (i.e.,  specimens 
removed  from  operating  steam  generators),  supplemented,  as  necessary,  by  tube  specimens  con¬ 
taining  flaws  fabricated  using  alternative  methods  provided  that  the  nondestructive  examination 
parameter  responses  from  these  flaws  are  fully  consistent  with  actual  in-service  degradation  of 
the  same  flaw  geometry. 

^Proposed  NRC  Generic  Letter,  "Steam  Generatur  Tube  Inspection  Techniques,"  SECY-97-280  ,December  3,  1997. 
NRC  Generic  Letter  97-05,  "Steam  Generatur  Tube  Inspection  Techniques,"  was  subsequently  issued  December  17 
1997. 
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8.3  Currently  Used  Component  —  Westinghouse  Model  F  Steam  Gen¬ 
erator 

The  candidate  PWR  uses  Westinghouse  Model  F  steam  generators  with  5626  Thermally  Treated 
Inconel  600  U-tubes  (SB-163)  that  are  hydravdically  expanded  into  the  tubesheet  at  each  end.  The 
current  NRC  inspection  guidelines  for  steam  generators  allow  for  periods  between  steam  genera¬ 
tor  eddy  current  testing  of  up  to  40  months.  This  interval  is  allowed  only  after  two  previous  suc¬ 
cessful  inspections  at  shorter  intervals.  However,  rather  than  accomodate  a  changing  inspection 
interval  in  maintenance  planning  most  PWRs  inspect  all  their  steam  generators  every  refueling 
outage  regardless  of  the  maximum  permitted  inspection  interval.  This  has  resulted  in  a  signifi¬ 
cant  amount  of  data  on  steam  generator  tubing  performance  collected  for  18-24  month  operating 
intervals  but  little  for  longer  intervals. 

8.4  IRIS  Steam  Generator  Design  and  Inspection 

The  maintenance  related  barriers  associated  with  currently  used  steam  generators  are  appli¬ 
cable  to  the  IRIS  steam  generator  design  but  one  fimdamental  operational  difference  exists.  In 
a  conventional  steam  generator,  the  higher  reactor  coolant  pressure  is  on  the  inside  of  the  steam 
generator  tubing.  Although  an  integral  pressurized  water  reactor  could  be  configured  to  have  the 
pressure  on  the  inside  of  the  tubing  also,  the  IRIS  steam  generators  will  have  the  reactor  coolant 
pass  over  the  tubing  rather  than  inside  of  it.  This  configuration  was  selected  because  it  reduces 
pressure  losses  in  the  reactor  coolant  loop  and  enhances  natural  circulation  flow,  which  is  a  key 
characteristic  in  the  IRIS  accident  mitigation  scheme. 

Regardless  of  whether  the  tubes  are  in  tension  (with  the  higher  pressure  on  the  inside  of  the 
tubing)  or  compression  (as  in  the  IRIS  design),  the  requirement  to  inspect  the  steam  generator 
tubing  does  not  change.  This  reversal  of  differential  pressure  compared  to  current  steam  genera¬ 
tors,  however,  makes  it  more  difficult  to  design  the  steam  generators  to  be  accessible  for  inspection 
since  the  inspection  method  is  not  necessarily  known.  Efforts  are  currently  imderway  by  the  IRIS 
team  to  identify  the  dominant  failure  mechanism  for  tubes  in  compression  (vice  tension,  which 
are  currently  inspected  using  eddy  current  techniques)  and  the  applicable  inspection  technique  to 


detect  this  failure  mechanism. 

Rather  than  delay  the  steam  generator  development,  it  is  assumed  that  whatever  inspection 
method  is  to  be  utilized  will  use  equipment  and  techniques  similar  to  eddy  current  testing  (i.e., 
an  active  element  on  a  cable  which  is  inserted  into  the  tube).  For  the  proposed  solutions  to  the 
accessibility  design  problem,  constraints  are  carried  over  to  the  inspection  technique  development 
problem.  There  is  a  risk  in  this  approach  that  the  equipment  to  perform  the  applicable  inspection 
technique  is  not  (as  assumed)  similar  to  eddy  current  testing.  However  it  is  possible  that  eddy 
current  testing  may  turn  out  to  be  the  applicable  inspection  technique  for  IRIS  steam  generators. 
And  if  it  is  not,  advances  in  miniaturizing  electronic  components  suggest  that  the  equipment 
to  perform  the  applicable  technique  is  likely  to  be  at  least  not  larger  than  current  eddy  current 
inspection  equipment. 

The  ultimate  selection  of  steam  generator  tube  configuration  (modular  helical-coil  or  u-tube) 
will  have  little  impact  on  the  accessibility  design  problem  (although  it  will  significantly  impact 
the  inspection  method).  All  proposed  configurations  will  have  channel  heads  with  the  tubes  pen¬ 
etrating  the  heads,  similar  to  the  conceptual  c-tube  design  of  Figure  8-2.  In  currently  used  steam 
generators,  such  as  the  Westinghouse  Model  F  above,  the  tubes  are  hydraulically  expanded  into 
the  tubesheet  and  a  pressure  tight  seal  is  created  when  the  tubes  are  internally  pressurized.  For 
IRIS,  the  tubes  will  tend  to  contract  when  externally  pressurized  which  could  lead  to  leakage  be¬ 
tween  the  tubes  and  channel  head.  Two  methods  will  be  utilized  to  mitigate  this  potential  leakage: 
(1)  a  collar  will  be  pressed  into  each  tube,  which  will  maintain  the  tube  pressed  against  the  channel 
head,  and  (2)  the  tubes  will  be  seal  welded  to  the  channel  head.  The  once-through  configuration  of 
the  IRIS  steam  generators  requires  the  flow  to  be  balanced  across  the  tube  bundle  within  a  steam 
generator,  so  the  tube  collar  will  also  function  as  an  orificing  device.  The  implication  of  these  ori- 
ficing  devices  is  that  a  large  active  element  may  be  difficult  (or  impossible)  to  insert  into  the  tube, 
necessitating  partial  steam  generator  disassembly  or  complete  removal  for  inspection. 

8.5  The  Steam  Generator  Tube  Inspection  Maintenance  Barrier 

Failure  of  any  given  steam  generator  tube  is  not  an  inevitable  occurance,  nor  is  failure  of  a 
single  tube  a  catastrophic  event.  However,  in  current  design  steam  generators  failure  of  a  steam 
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Top  View 


From  R/V  Inside  View 


Figure  8-2:  Conceptual  Drawing  of  IRIS  C-Tube  Steam  Generator 

generator  tube  does  compromise  the  RCPB  and  can  lead  to  a  significant  loss  of  primary  coolant 
and  contamination  of  the  steam  system  if  not  immediately  detected.  Therefore,  steam  generator 
tube  failure  must  be  prevented  for  both  safety  and  investment  protection  reasons.  Currently,  steam 
generator  tube  failure  is  prevented  by  detecting  and  eliminating  conditions  which  are  known  to 
potentially  lead  to  tube  failure. 

For  IRIS,  meeting  the  operating  cycle  length  goal  requires  one  of  the  following  conditions: 

•  Eliminating  the  conditions  which  potentially  lead  to  tube  failure  allowing  the  inspection 
interval  to  be  extended  to  a  periodicity  consistant  with  the  operating  cycle  length, 

•  Eliminating  the  use  of  the  steam  generator  tubes  as  a  reactor  coolant  pressure  boundary 
eliminating  the  requirement  to  conduct  tube  inspections,  or 

•  Making  the  tube  bundle  accessible  for  inspection  at  power. 

At  this  early  stage  of  IRIS  development,  it  is  not  reasonable  to  assume  that  the  conditions 
which  potentially  lead  to  tube  failure  can  be  eliminated  since  they  have  not  yet  been  identified. 
The  second  option,  moving  the  reactor  coolant  pressure  boimdary,  is  also  not  feasible  since  it 
would  make  portions  of  the  steam  and  feed  systems  (from  the  steam  generators  to  the  main  steam 


isolation  valves  and  feedwater  isolation  valves)  part  of  the  RCPB  and  these  components  would 
need  to  be  designed  to  the  higher  reactor  coolant  system  pressure  and  tested  as  an  active  safety 
system.  Designing  a  complex  system  to  accomodate  failure  of  a  component  is  certainly  prudent, 
but  accomodating  the  failure  simply  because  the  designer  chooses  not  to  take  adequate  and  rea¬ 
sonable  steps  (such  as  periodic  inspections)  to  prevent  the  failure  circumvents  the  intent  of  the 
regulations  to  ensure  mechanical  integrity  of  the  RCPB.  Therefore,  resolving  the  steam  generator 
tube  inspection  maintenance  barrier  requires  development  of  a  means  to  perform  the  required 
inspections  at  power. 

8.6  Application  of  the  Design  Resolution  Methodology 

8.6.1  Currently  Used  Component 

The  currently  used  steam  generator  does  not  meet  the  functional  requirement  for  a  compact 
internal  steam  generator.  Based  on  the  significant  design  differences  between  currently  operating 
PWRs  and  IRIS,  no  component  modifications  can  be  made  which  will  make  a  design  like  the 
Westinghouse  Model  F  suitable  for  use  in  IRIS.  However,  analysis  of  the  Model  F  is  not  without 
benefit  since  much  of  the  maintenance  performed  on  the  Model  F  will  also  be  performed  on  the 
IRIS  steam  generators. 

8.6.2  Isolating  Steam  Generators  for  Inspection 

Section  11.3,  'IRIS  Integrated  Testing  and  Coordinated  Maintenance,'  describes  a  comprehen¬ 
sive  inspection  scheme  to  perform  required  maintenance  with  the  steam  generator  isolated  but  the 
reactor  still  at  power.  For  this  steam  generator  inspection  to  be  conducted,  consideration  must  be 
given  to  the  extremes  of  temperature  and  radiation  present  inside  the  steam  generator  (for  equip¬ 
ment)  and  in  the  vicinity  of  the  reactor  vessel  (for  personnel).  Therefore,  the  inspection  equipment 
must  remotely  operated  with  the  following  characteristics: 

•  The  inspection  equipment  must  be  flexible  enough  to  make  up  to  a  180-degree  bend  and  be 
directed  into  the  desired  tube,  yet  rigid  enough  to  be  pushed  through  all  turns  (including  the 
multiple  turns  of  a  helical-coil  steam  generator).  To  transit  the  entry  path  and  through  the 


tube  may  require  an  additional  force  (such  as  flow,  which  would  result  in  the  generation  of 
steam).  To  find  the  desired  tube  implies  an  imaging  capability,  although  physically  marking 
the  tubes  at  the  entrance  (such  as  unique  etched  bands)  would  allow  tube  identification  after 
inserting  the  active  element. 

•  Current  eddy  current  inspection  equipment  requires  small  tolerances  between  the  coil  and 
the  tube  wall  for  sensitivity  and  accuracy.  The  inspection  method  must  be  such  that  active 
element  (probe,  coil,  transducer,  etc.)  is  small  enough  to  fit  into  the  flow  orificing  device  yet 
still  maintain  directional  detection  accrtracy. 

•  The  inspection  device  must  be  able  to  be  removed  for  inspection  and  calibration.  This  is  most 
feasibly  accomplished  by  inserting  the  inspection  equipment  into  the  line  used  to  drain  the 
steam  generator  after  conducting  the  integrated  safety  test.  However  the  inspection  equip¬ 
ment  penetration  into  the  feedwater  system  must  be  pressure  tight  to  provide  personnel 
protection  and  prevent  primary  coolant  loss  in  the  unlikely  event  of  tube  failure  during  in¬ 
spection. 

8.6.3  Continuous  On-Line  Inspection 

A  potential  use  of  the  method  described  above  for  isolated  steam  generator  inspection  is  as  a 
continuous  on-line  method.  Rather  than  guiding  the  active  element  into  a  particular  tube,  normal 
feedwater  flow  could  be  used  to  force  the  active  element  into  a  random  tube  (which  will  be  posi¬ 
tively  identified  by  the  active  element)  as  the  inspection  equipment  control  cable  is  let  out.  If  the 
channel  head  entrance  is  sufiiciently  turbulent,  then  every  tube  will  have  a  non-zero  probability 
that  the  active  element  will  enter  that  specific  tube.  Therefore,  the  inspection  rate  must  be  high 
enough  to  ensure  a  high  statistical  likelihood  of  all  tubes  being  inspected  during  a  specified  in¬ 
terval.  If  all  tubes  are  not  inspected  during  the  interval,  then  an  assessment  must  be  made  based 
on  the  number  of  inspections  made  and  the  number  of  tubes  inspected  whether  a  representative 
sample  has  been  collected  to  ensure  the  reliability  of  all  tubes  in  that  generator. 


8.6.4  ^Intelligent'  Inspection  Methods 


Early  research  is  being  conducted  on  'intelligent'  inspection  methods  which  use  microminia¬ 
ture  electronics  in  a  small  probe  which  travels  in  the  fluid  stream.  The  probe  is  inserted  into  the 
system  and  gathers  data  as  it  traverses  the  system  to  the  exit  point.  For  steam  generator  tube 
inspection,  the  probe  would  need  to  be  small  enough  to  be  entrained  by  the  flowing  steam  and 
carried  to  an  exit  point  in  the  main  steam  header.  At  this  point,  the  probes  imder  development 
cannot  localize  detected  flaws  and  thus  provides  only  an  indication  that  a  flaw  exists  somewhere 
in  the  (unknown)  flow  path. 


8.7  Summary 

This  chapter  has  addressed  the  steam  generator  tube  integrity  inspection  barrier,  and  a  sum¬ 
mary  of  design  solution  alternatives  is  presented  in  Table  8.1.  Although  more  steam  generator 
design  definition  is  required  to  fully  analyze  this  barrier,  steam  generator  tube  integrity  inspec¬ 
tion  will  be  the  greatest  challenge  to  achieving  the  target  operating  cycle  length.  Fundamentally,  a 
satisfactory  solution  will  not  be  developed  without  a  significant  technology  investment  that  iden¬ 
tifies  and  develops  a  novel  technique  for  performing  the  required  inspections. 


Table  8.1:  Steam  Generator  Tube  Inspection  Alternatives  Summary 
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Chapter  9 

Application  of  Resolution 
Methodology-Main  Condenser 

9.1  Introduction 

The  main  condenser  is  the  primary  heat  sink  for  the  power  plant,  and  the  ability  to  effectively 
transfer  heat  to  the  main  condenser  is  vital  to  the  efficient  performance  of  the  entire  plant.  If 
the  main  condenser  heat  transfer  capability  is  degraded,  the  plant  must  be  either  operated  at 
lower  power  (to  maintain  condenser  operating  conditions)  or  risk  overheating.  At  it's  extreme, 
overheating  can  lead  to  potentially  severe  condenser  shell  damage  such  as  overpressurization 
and  rupture. 

The  primary  contributors  to  main  condenser  heat  transfer  degradation  are  clogging  and  foul¬ 
ing  of  the  inlet  tube  sheets  and  tubes  from: 

•  biofouling  (organic  debris  that  adheres  to  the  inside  diameter  of  the  tube  surface  or  blocks 
the  intake  flow  at  the  tubesheet), 

•  slime/algae  (bacteria  that  adheres  to  the  condenser  tube  surface  and  reduces  the  usable  tube 
surface  area  and  cooling  water  flow  area  while  aggravating  and  accelerating  corrosion,  ero¬ 
sion  and  pitting  of  the  condenser  tubes), 

•  barnacles/mussels/clams  (small  marine  creatures  which  block  cooling  water  flow  at  the 
tubesheet  and/or  adhere  to  the  inner  diameter  of  the  tube  surface  which  increases  flow 


velocity  and  accelerates  tube  erosion), 

•  lodged  foreign  material  (which  causes  flow  deflection  leading  to  localized  pitting  and  ero¬ 
sion),  and 

•  scale  (a  hard  deposit  that  adheres  to  the  condenser  tube  surface  which  reduces  heat  transfer, 
decreases  plant  performance,  and  causes  pitting  of  the  condenser  tubes). 

All  tube  fouling  will  increase  flow  velocity,  reduce  heat  transfer,  increase  back  pressure  and  de¬ 
crease  efficiency  of  the  condenser. 

9.2  Main  Condenser  Cleaning  and  Inspection  Barrier 

Current  nuclear  power  plants  were  typically  outfitted  with  shell  and  straight-tube  (copper) 
condensers  with  two  or  three  waterboxes.  At  that  time,  due  to  the  relatively  short  fuel  cycle,  it 
was  anticipated  that  although  fouling  would  occur  it  would  not  result  in  significant  degradation 
of  the  overall  plant  thermal  efficiency.  Operating  experience  revealed  this  assumption  to  be  overly 
optimistic.  Plants  experienced  significant  reductions  in  thermal  efficiency  (especially  those  using 
silted  brackish  water)  as  well  as  accelerated  corrosion  leading  to  tube  leaks. 

As  a  result  of  the  early  condenser  experiences  many  plants  have  changed  (or  plan  to  change) 
their  condenser  tubes  to  titanium,  which  is  much  less  susceptible  to  corrosion.  To  control  fouling  a 
number  of  strategies  have  been  employed  to  chemically  treat  and/or  mechanically  filter  the  inlet 
cooling  water.  The  extent  to  which  a  given  plant  employs  these  methods  depends  strongly  on 
the  economic  balance  between  capital  investment  in  the  systems  and  the  ability  of  the  systems 
to  maintain  (or  slow  the  reduction  of)  plant  overall  thermal  efficiency.  In  some  cases,  excessive 
fouling  cannot  be  prevented  for  an  entire  operating  cycle  and  a  mid-cycle  reduced  power  window 
is  required  to  sequentially  clean  the  waterboxes. 

Even  with  the  IRIS  mid-cycle  maintenance  shutdown  strategy  (at  the  48  month  point),  a  means 
to  clean  the  main  condenser  waterboxes  during  the  cycle  must  be  provided.  Design  strategies 
which  enable  main  condenser  waterbox  cleaning  are  discussed  below. 
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9.3  Application  of  the  Design  Resolution  Methodology 


Evaluation  of  the  IRIS  requirements  and  main  condenser  operating  history  using  the  method¬ 
ology  of  Chapter  5  leads  to  the  conclusion  that  advances  in  condenser  materials  will  not  allow  for 
extended  operating  cycles  without  significant  fouling,  and  so  a  means  to  clean  the  main  condenser 
tubes  at  power  must  be  developed.  Design  solution  alternatives  which  meet  the  requirements  are 
described  below. 

9.3.1  On-Line  Cleaning  Enabled  by  Multiple  Waterboxes 

Access  to  the  condenser  tubes  during  condenser  operation  can  be  readily  enabled  by  utiliz¬ 
ing  multiple  (independently  isolable)  waterboxes.  The  strategy  requires  using  n  waterboxes,  each 
with  enough  heat  removal  capability  such  that  only  n-1  waterboxes  are  required  to  remove  the 
maximum  plant  heat  load  at  the  least  efficient  condenser  conditions.  These  conditions  are  cal¬ 
culated  assuming  maximum  tube  fouling  for  all  on-service  waterboxes,  worst  case  cooling  water 
conditions  (maximum  inlet  temperature,  minimum  flowrate),  all  auxiliary  steam  loads  secured, 
and  maximum  plant  thermal  power  (including  instrumentation  uncertainties).  The  net  effect  of 
these  assumed  conditions  is  to  have  maximum  condenser  heat  input  under  worst-case  heat  re¬ 
moval  conditions. 

Although  this  method  will  enable  access  for  tube  cleaning,  it  suffers  from  two  significant  draw¬ 
backs:  cleaning  is  man-intensive  and  increasing  the  number  of  waterboxes  increases  condenser 
complexity  (leading  to  increased  capital  cost).  The  condenser  is  a  large  component  which  is  fab¬ 
ricated  and  assembled  from  a  large  number  of  metal  parts,  and  is  a  small  but  significant  portion 
(typically  on  the  order  of  2-3%)  of  the  total  capital  investment.  A  detailed  analysis  is  necessary 
to  find  the  optimal  economic  point  which  balances  the  number  of  waterboxes  against  the  amount 
of  installed  over-capacity  per  waterbox.  General  discussions  conducted  with  a  condenser  manu¬ 
facturer  indicated  that  the  optimal  number  of  waterboxes  is  on  the  order  of  ten  (each  with  10% 
over-capacity). 
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9.3.2  On-Line  Cleaning 


Improved  on-line  cleaning  methods  have  emerged  in  recent  years  which  are  effective  in  reduc- 
ing  fouling  to  the  point  where  a  through  off-line  mechanical  cleaning  is  required  only  infrequently 
(on  the  order  of  ten  years).  Two  metirods  dominate  the  on-line  cleaning  market,  brush-type  and 
ball-t)q)e.^  Both  methods  pass  an  abrasive  device  through  the  condenser  tubes,  using  the  differ¬ 
ential  pressure  across  the  waterbox  to  move  ihe  device.  However,  although  both  methods  are 
generally  effective  enough  to  prevent  heat  transfer  degradation  the  entire  tube  circumference  may 
not  be  throughly  cleaned.  This  streaking  inside  the  tube  can  result  in  conditions  conducive  to 
galvamc  corrosion,  although  titanium  tubes  are  much  less  susceptible. 

9.3.2.1  Brush-Type  On-Line  Condenser  Cleaning  System 

In  the  brush-type  method  (Figure  9-1)  a  brush  is  inserted  into  each  condenser  tube.  A  perfo¬ 
rated  basket  is  attached  to  the  end  of  each  condenser  tube  which  prevents  the  brush  from  leaving 
the  tube  and  entering  the  inlet  or  outlet  waterbox  head.  A  diverter  valve  is  installed  between 
the  tubeside  piping  to  and  from  the  unit,  and  is  used  to  reverse  flow  direction  through  waterbox 
causing  the  brushes  to  travel  from  one  basket  (through  the  tube)  to  the  other  basket.  Figure  9-l(a) 
shows  the  flow  diverter  in  the  standby  normal  flow  position.  With  flow  in  the  normal  direction, 
the  brushes  rest  in  their  "home"  baskets.  The  flow  diverter  is  shown  in  the  reverse  flow  position  in 
Figure  9-l(b).  The  brushes  are  carried  through  the  tubes,  cleaning  as  they  pass  through  the  tubes. 
The  brushes  are  caught  by  the  "temporary"  catch  baskets  at  the  opposite  ends  of  the  tubes  and 
held  there  for  a  brief  period.  When  the  flow  diverter  is  brought  back  to  the  normal  flow  position, 
the  brushes  are  carried  back  through  the  tubes  to  their  "home"  positions  where  they  wait  until  the 
next  cleaning  cycle  is  initiated.  After  sufficient  time  delay,  the  diverter  valve  reverses  the  flow  di¬ 
rection  through  the  waterbox  causing  the  brush  to  again  travel  the  length  of  the  tube.  This  process 
is  repeated  until  the  waterbox  thermal  performance  is  restored. 

There  are  several  manufacturers  of  both  brush-type  and  ball-type  condenser  tube  cleaning  systems.  The  figures 
and  descriptions  here  are  for  systems  manufactured  by  WSA  Engineered  Systems,  Milwaukee,  WI. 


(a)  Standby  Position 


(b)  Reverse  Flow  Position 

Figure  9-1:  Brush-Type  On-Line  Condenser  Cleaning  System  Flowpath 


Figure  9-2:  Ball-Type  On-Line  Condenser  Cleaning  System  Operation.  Abrasive  balls  are  pumped 
from  the  collection  vessel  to  the  injector,  where  they  enter  the  condenser  waterbox  inlet  head. 
After  passing  through  a  random  tube,  the  balls  are  captured  by  the  strainer  and  directed  (via  the 
recirculation  pump)  to  the  collection  vessel. 


93.2.2  Ball-Type  On-Line  Condenser  Cleaning  System 

The  ball-type  method  (Figure  9-2)  uses  a  large  number  of  abrasive  balls  which  are  introduced  # 

into  the  inlet  cooling  water  stream,  pass  through  the  condenser  tubes,  and  are  recovered  from 
the  outlet  cooling  water  stream.  Unlike  the  brush- type  method  (where  one  brush  is  uniquely 
associated  with  one  tube)  this  method  does  not  ensure  that  a  cleaning  ball  will  (even  after  several 
passes)  travel  through  any  individual  tube.  ^ 
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9.4  Summary 


This  chapter  has  presented  several  alternatives  for  consideration  in  the  IRIS  design.  The  first 
alternative  is  simply  an  extension  of  current  design  practice  to  make  waterboxes  isolable  and 
accessible.  The  two  on-line  methods  described  use  an  abrasive  object  (brush  or  ball)  which  cleans 
the  condenser  tube  as  it  passes  through. 

Table  9.1  summarizes  the  alternatives  qualitatively  ranked  by  maintainability,  economic  via¬ 
bility,  and  technology  risk.  Within  the  alternatives  generated,  installation  of  n-1  waterbox  redun¬ 
dancy  presents  essentially  no  technology  risk  since  it  is  a  simple  extension  of  today's  technology. 
However,  without  an  economic  assessment  of  the  cost  impact  of  fiie  additional  waterboxes,  valves, 
and  associated  piping  a  recommendation  of  the  best  alternative  to  pursue  cannot  be  made. 


Table  9.1:  Main  Condenser  Cleaning  Alternatives  Summary 
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Chapter  10 


Application  of  Resolution 
Methodology-Turbine  Generator 
Throttle  Control 

10.1  Introduction 

The  main  turbine  generator  is  a  multi-stage  steam  driven  turbine  coupled  directly  to  a  large 
three  phase  generator.  Current  turbine  generators  use  an  electro-hydraulic  control  (EHC)  system 
to  position  hydraulically-actuated  throttle  valves  which  control  steam  flow  to  the  turbine.  Once 
synchronized  to  the  grid,  the  turbine  generator  rotates  at  constant  speed  and  steam  flow  controls 
the  amount  of  power  sent  to  the  grid.  Nuclear  generation  is  typically  used  for  baseline  loading, 
and  little  throttle  valve  movement  is  necessary  for  long  periods  once  the  plant  is  at  maximum 
power.  When  throttle  valve  movement  is  required,  electric  signals  are  sent  to  electrically-actuated 
control  valves  which  reposition  and  allow  the  system  hydraulic  fluid  to  operate  on  the  throttle 
valves. 

10.2  Main  Turbine  Generator  Maintenance  Barrier 

When  the  turbine  generator  is  synchronized  to  the  grid  and  producing  constant  (maximum) 
power,  little  hydraulic  fluid  flows  through  the  EHC  system.  As  a  result,  impurities  and  wear 
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products  (sludge)  in  the  hydraulic  fluid  collect  in  low  flow  regions.  These  regions  typically  are 
in  the  immediate  vicinity  of  the  electrically-actuated  control  valves,  and  often  lead  to  sluggish 
control  valve  actuation. 

When  this  sluggish  actuation  occurs,  the  EHC  system  does  not  respond  as  expected  and  the 
turbine  generator  throttle  valve  tends  to  cycle  about  the  desired  operating  point.  This  leads  to  a 
plant  power  output  to  the  grid  which  oscillates  about  the  mean  (maximum)  power  point.  If  al¬ 
lowed  to  grow,  the  oscillation  peak  can  lead  to  generator  overheating  and  potential  stator  damage. 

Operating  experience  with  current  EHC  systems  shows  that  the  system  operates  reliably  for 
the  current  operating  cycle  length  (on  the  order  of  24  months),  but  that  sludge  deposits  do  form. 
Extrapolating  this  performance  data  to  longer  operating  cycles  indicates  that  reliable  operation 
cannot  be  ensured. 

10.3  Application  of  the  Design  Resolution  Methodology 

Evaluation  of  the  IRIS  requirements  and  main  turbine  generator  EHC  system  operating  his¬ 
tory  using  the  methodology  of  Chapter  5  leads  to  the  conclusion  that  advances  in  the  throttle 
control  system  to  prevent  sludge  buildup  in  low  hydraulic  fluid  flow  regions  must  be  developed. 
Potential  design  solution  alternatives  which  support  development  of  an  advanced  EHC  system 
are  described  below. 

10.3.1  Prevention  of  Sludge  Buildup 

The  root  cause  of  the  EHC  system  reliability  issue  is  inadequate  hydraulic  fluid  flow  through 
the  EHC  system.  In  other  low  hydraulic  flow  applications,  this  problem  is  solved  by  sending 
dithering  signals  in  a  programmed  sequence  to  the  control  valves  causing  them  to  stroke  and 
disturb  the  low  flow  regions.  If  sufficient  control  valves  exist  in  the  system  (which  is  the  case  for  a 
modem  turbine  generator  EHC  system)  then  these  dithering  signals  move  only  a  small  amount  of 
hydraulic  fluid  from  control  valve  to  control  valve  and  do  not  result  in  motion  of  the  hydraulically- 
actuated  component.  Although  'as-built'  turbine  generators  did  not  have  this  feature,  dithering 
systems  are  finding  increasing  application  in  turbine  generator  control  systems  for  both  baseline 
and  load  following  applications. 


Another  technique  which  addresses  the  low  hydraulic  fluid  flow  problem  is  the  use  of  ultra¬ 
sonic  transducers  to  agitate  the  hydraulic  fluid  at  high  frequency  to  prevent  sludge  from  settling. 
Unlike  the  dithering  technique  which  surges  hydraulic  fluid  from  one  control  valve  to  the  next, 
this  method  simply  keeps  the  sludge  suspended  in  the  fluid  allowing  it  to  move  through  the  sys¬ 
tem  when  the  control  valves  are  actuated. 

Finally,  synthetic  oils  typically  contain  much  less  impurities  than  do  petroleum  fluids  and  have 
(or  can  be  formulated  to  have)  similar  properties.  Synthetic  oil  types  include  polyalphaolefins, 
diesters,  polyol  esters,  alkylbertzenes,  polyalkylene  glycols,  phosphate  esters,  silicones,  and  halo- 
genated  hydrocarbons.  Synthetic  oils  are  generally  organic  compoxmds  and  cost  much  more  than 
petroleum  oils.  However,  each  type  has  one  (or  more)  specific  properties  that  are  better  than 
petroleum  oils,  and  the  limitations  can  generally  be  corrected  by  chemical  additives.  For  IRIS, 
a  detailed  analysis  of  the  EHC  system  characteristics  must  be  made  to  match  the  synthetic  oil 
properties  to  the  application. 

10.3.2  Electric  Control  System 

A  control  system  which  uses  electric  linear  motors  to  position  the  throttle  valves  would  not  be 
subject  to  the  stability  problems  experienced  by  an  EHC  system.  However,  there  is  no  industry 
impetus  or  manufacturer  initiatives  to  improve  the  current  technology  EHC  system  (since  it  is 
generally  reliable  throughout  the  current  operating  cycle).  Therefore,  a  significant  research  and 
development  expenditure  would  be  necessary  to  make  an  electric  control  system  commercially 
viable. 

10.4  Summary 

In  procuring  a  main  turbine  generator,  performance  specifications  are  typically  given  to  the 
manufacturer  and  then  the  manufacturer  uses  it's  own  technologies  to  meet  those  specifications. 
Reactor  plant  designers  rarely  are  involved  directly  in  the  main  turbine  generator  design.  The 
IRIS  design  team  intends  to  be  indirectly  involved  in  the  main  turbine  generator  design  process, 
funding  research  initiatives  where  necessary  and  applicable.  Directly  designing  a  main  turbine 
generator  system  (including  throttle  control  system)  does  not  adequately  leverage  the  design  ex- 
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perience  of  the  manufacturer  and  involves  significant  technology  and  economic  risk. 

It  is  likely  that  integrating  available  current  technologies  into  the  EHC  system  is  more  cost 
effective  than  development  of  an  advanced  technology  control  system.  Only  operating  experience 
with  this  improved  system  will  determine  if  this  solution  meets  the  long-term  IRIS  target  cycle 
length  goal  of  eight  years,  but  it  is  anticipated  that  this  improved  EHC  system  will  operate  reliably 
for  at  least  four  (and  possible  to  eight)  years.  This  'operate  and  assess'  strategy  has  been  adopted 
by  the  IRIS  design  team  to  maximize  the  potential  for  success  while  minimizing  risk. 
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Chapter  11 


Application  of  Resolution 
Methodology-Reduced  Power  Window 
Surveillances 

11.1  Introduction 

There  are  a  large  number  of  investment  protection  based  surveillances  (67  total)  which  are  cur¬ 
rently  performed  off-line  but  could  be  performed  on-line  at  reduced  power.  Most  of  these  surveil¬ 
lances  have  performance  intervals  much  less  than  48  months  (tj^ically  18  months)  and  therefore 
can  also  be  considered  to  be  barriers  to  a  48  month  (full  power)  operating  cycle.  These  surveil¬ 
lances  have  been  generalized  into  six  broad  categories,  and  their  resolution  in  IRIS  is  described 
below. 

11.2  Resolution  of  Reduced  Power  Window  Surveillances 

11.2.1  Circulating  Water/Service  Water  Pump  and  Traveling  Screen  Inspections 

To  conduct  the  required  pump  and  traveling  screen  inspections  requires  one  traveling  screen- 
pump-heat  exchanger  train  to  be  secured  and  drained.  At  the  candidate  PWR  there  are  three 
identical  parallel  trains,  each  capable  of  removing  approximately  46%  of  the  maximum  heat  load. 
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Therefore,  when  one  train  is  secured  for  inspection  the  total  plant  power  (which  is  proportional 
to  heat  load)  is  limited  to  approximately  92%.  In  IRIS,  additional  train  heat  removal  capacity  or 
additional  redtmdancy  will  be  utilized  to  allow  these  surveillances  to  be  conducted  on-line  with 
no  power  restrictions. 

11.2.2  Generator  Stator  Cooling 

Current  main  turbine  generator  sets  use  two  identical  cooling  loops  to  cool  the  generator  stator, 
both  of  which  must  be  on-line  for  full  power  operation.  As  above,  this  limitation  can  be  readily 
solved  in  IRIS  using  by  adding  redundancy  to  allow  one  cooling  loop  to  be  removed  from  service 
with  no  power  restrictions. 

11.2.3  Main  Turbine  Lube  Oil  System  Pressure  Switch  Calibrations 

These  surveillances  can  be  performed  on-line  with  adequate  installed  redundancy.  Installa¬ 
tion  of  one  additional  pressure  switch  would  maintain  the  original  number  of  required  on-service 
switches  while  allowing  one  to  be  removed  from  service  for  testing  or  repair.  To  avoid  an  in¬ 
advertent  turbine  generator  trip,  a  digital  trip  control  system  will  need  to  be  developed  but  the 
technology  required  is  foimded  in  current  practices. 

11.2.4  Nuclear  Instrument  Calibration 

Calibration  of  the  power  range  nuclear  instruments  cannot  be  conducted  without  a  change  in 
power  level  since  a  single  data  point  cannot  establish  the  required  instrument  gain  setting  (i.e., 
the  slope  of  the  calibration  curve).  The  current  calibration  method  requires  steady  power  to  be 
maintained  at  a  low  level  (approximately  20%  reactor  power)  for  data  collection  and  then  at  high 
(near  maximum)  power.  New  techniques  are  being  developed^  which  use  automatic  data  collec¬ 
tion  from  in-core  flux  monitors  and  require  only  a  small  reduction  in  reactor  power  (without  a 
change  in  steam  flow).  This  technology  is  anticipated  to  be  available  in  1-3  years. 

’"An  In-Core  Power  Deposition  and  Fuel  Thermal  Environmental  Monitor  for  Long-Lived  Reactor  Cores,"  U.S.  De¬ 
partment  of  Energy  Nuclear  Energy  Research  Initiative,  Proposal  No.:  2000-069,  awarded  to  Ohio  State  University 


11.2.5  Main  Steam  Isolation  Valve  Maintenance 


Main  steam  isolation  valve  stroke  check  and  actuating  system  surveillances  will  be  conducted 
as  part  of  the  integrated  passive  safety  systems  operability  testing  described  in  Section  11.3  below. 

11.2.6  Feedwater  System  Inspections  and  Calibrations 

These  surveillances  will  be  conducted  as  part  of  the  integrated  passive  safety  systems  oper¬ 
ability  testing  described  in  Section  11.3  below. 

11.3  IRIS  Integrated  Testing  and  Coordinated  Maintenance 

Based  on  the  AP600  proof  of  operability  burden,  it  is  anticipated  that  demonstrating  operabil¬ 
ity  of  the  IRIS  passive  cooling  scheme  will  require  initiation  of  cooling  and  measurement  of  both 
cooling  loop  flowrate  and  heat  transferred  to  the  heat  sink.  Although  the  flowrate  and  heat  trans¬ 
fer  can  be  determined  a  priori  for  the  (at  power)  primary  coolant  circuit  conditions,  proper  flow 
conditions  in  the  passive  cooling  loop  will  not  be  established  without  steam  and  feed  flow  being 
secured.  Therefore,  this  operability  test  could  be  conducted  with  the  reactor  at  power  but  with  the 
steam  and  feed  headers  for  the  passive  cooling  loop  secured.  This  corresponds  to  75%  total  steam 
flow  (three-fourths  of  all  installed  steam  generators  operating)  for  testing. 

The  integrated  test  begins  with  isolation  of  steam  and  feed  flow  for  the  header  being  tested, 
followed  by  initiation  of  passive  cooling  flow,  and  ends  with  measurement  of  the  parameters  nec¬ 
essary  to  demonstrate  operability.  After  conducting  the  operability  test,  the  passive  cooling  system 
is  then  drained  to  allow  for  in-situ  steam  generator  tube  inspections  (if  these  inspections  cannot 
be  deferred  to  a  maintenance  outage).  Finally,  necessary  maintenance  on  the  main  steam  isola¬ 
tion  and  feedwater  isolation  valves  is  performed.  After  completion  of  maintenance  and  before 
restoring  normal  operation,  feedwater  regulating  valve  maintenance  and  feed  pump  maintenance 
is  conducted  as  well  as  the  containment  safety  features  response  time  testing  of  Chapter  6,  Sec¬ 
tion  6.2.1. 2.  It  is  estimated  that  this  entire  maintenance  block  can  be  completed,  for  one  passive 
cooling  circuit,  in  one  week. 

Also  to  be  considered  is  reactivity  control  testing  which  may  need  to  be  conducted.  Oper¬ 
ation  within  the  reactor  safety  analysis  assumptions  regarding  rod  control  system  performance 


cannot  be  assured  for  eight  years  of  continuous  operation  without  demonstration  of  the  normal 
and  emergency  reactor  shutdown  mechanism.  The  IRIS  team  is  currently  examining  different  re¬ 
activity  control  and  reactor  shutdown  methods,  so  it  is  not  possible  at  this  point  to  identify  likely 
testing  requirements.  What  can  be  assumed,  however,  is  the  core  design  must  allow  for  at-power 
testing  of  the  reactor  shutdown  mechanisms  if  a  mid-cycle  reactor  shutdown  is  to  be  avoided. 

From  the  above  testing  profile,  it  is  estimated  that  IRIS  will  enter  a  two  week  75%  power 
window  every  two  years  (testing  two  passive  cooling  loops  sequentially  during  each  reduced 
power  outage).  Therefore,  IRIS  will  operate  75%  power  for  two  weeks  every  two  years  or  six 
weeks  over  the  entire  eight-year  fuel  cycle.  The  fourth  testing  and  maintenance  period  would  be 
scheduled  to  coincide  with  the  refueling  outage.  Including  a  one-month  refueling  outage  over  the 
96  week  fuel  cycle,  the  conservatively  estimated  theoretical  imit  capability  factor  is  98.4%. 

11.4  Reduced  Power  Surveillance  Strategy 

It  is  unlikely  that  design  solutions  for  all  barriers  with  periodicities  less  than  eight  years  can 
be  found  to  allow  maintenance  to  be  performed  on-line  without  power  restriction.  Although  this 
thesis  has  attempted  to  assist  in  developing  design  solutions  which  enable  this  condition,  surveil¬ 
lances  have  been  identified  (specifically,  safety  system  operability  demonstration  and  steam  gen¬ 
erator  tube  integrity  inspections)  which  cannot  feasibly  be  performed  on-line  without  a  very  sig¬ 
nificant  technology  development  effort.  Therefore,  given  that  a  reduced  power  window  will  be 
required  a  strategy  that  considers  capital  investment,  investment  protection  requirements,  and 
availability  should  be  developed. 

For  example,  the  design  solution  which  allows  performing  circulating  and  service  water  sys¬ 
tem  maintenance  (Subsection  11.2.1,  above)  is  installation  of  redundancy.  However,  if  this  main¬ 
tenance  were  scheduled  for  completion  during  a  reduced  power  window  then  the  capital  invest¬ 
ment  for  an  additional  cooling  train  can  be  avoided  without  impacting  overall  plant  availability. 
This  analysis  is  beyond  the  scope  of  this  thesis,  but  is  described  here  since  it  contributes  to  an 
overall  soimd  design  strategy. 
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11.5  Summary 


Design  solutions  to  the  most  significant  of  the  identified  maintenance  barriers  requiring  re¬ 
duced  power  have  been  proposed,  with  the  notable  exception  of  safety  system  operability  testing. 
Therefore,  given  that  a  reduced  power  window  is  required  in  IRIS,  a  strategy  which  minimizes 
the  duration  of  this  window  has  been  proposed.  This  strategy  meets  the  current  regulatory  re¬ 
quirements  for  operability  demonstration  without  significant  regulatory  changes  or  technological 
advances. 

It  must  be  recognized  that  a  balanced  economic  strategy  does  not  always  justify  the  required 
investment  to  eliminate  reduced  power  windows.  Development  of  materials  and  technologies 
to  eliminate  currently  unresolvable  reduced  power  surveillances  potentially  requires  a  large  re¬ 
search  and  development  investment  and  delay  in  fielding  such  solutions.  Also,  the  capital  cost  of 
solutions  which  require  the  installation  of  additional  capacity  or  redundancy  may  not  be  justified 
relative  the  the  reduction  in  availability  from  performing  maintenance  of  lower  capacity  systems 
during  a  reduced  power  window. 
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Chapter  12 


Summary  and  Future  Work 


12.1  Summary 

A  renewed  interest  in  new  nuclear  power  generation  in  the  United  States  has  spurred  interest 
in  developing  advanced  reactors  with  features  which  will  address  the  public's  concerns  regarding 
nuclear  generation.  However,  it  is  economic  performance  which  will  dictate  whether  any  new 
orders  for  these  plants  will  materialize  in  the  next  decade.  Economic  performance  is,  to  a  great 
extent,  improved  by  maximizing  the  time  that  the  plant  is  on-line  generating  electricity  relative 
to  the  time  spent  off-line  conducting  maintenance  and  refueling.  Indeed,  the  strategy  for  the 
advanced  light  water  reactor  plant  IRIS  (International  Reactor,  Innovative  &  Secure)  is  to  utilize 
an  eight  year  operating  cycle. 

A  formalized  strategy  to  address,  during  the  design  phase,  the  maintenance-related  barriers  to 
an  extended  operating  cycle  does  not  exist.  Therefore,  the  top-level  objective  of  this  thesis  was  to 
develop  a  methodology  for  injecting  component  and  system  maintainability  issues  into  the  reactor 
plant  design  process  to  overcome  these  barriers. 

A  primary  goal  was  to  demonstrate  the  applicability  and  utility  of  the  methodology  in  the 
context  of  the  IRIS  design.  The  methodology  developed  has  been  demonstrated  to  narrow  the 
design  space  to  feasible  design  solutions  which  enable  a  desired  operating  cycle  length,  yet  is 
general  enough  to  have  broad  applicability.  Feedback  from  the  IRIS  design  team  indicates  that 
the  proposed  solutions  to  the  investigated  operating  cycle  length  barriers  are  both  feasible  and 
consistent  with  sound  design  practice. 
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12.1.1  Methodology  Development 

The  first  step  in  meeting  the  top-level  objective  was  to  determine  the  t)^es  of  operating  cycle 
length  barriers  that  the  IRIS  team  is  likely  to  face.  An  investigation  into  the  regulatory  and  in¬ 
vestment  protection  surveillance  program  barriers  preventing  a  candidate  operating  PWR  from 
achieving  an  extended  (48  month)  cycle  has  been  recently  completed.^  This  presented  a  logical 
starting  point,  and  the  results  of  the  operating  PWR  investigation  were  examined  in  the  context 
of  the  IRIS  design.  Relative  to  IRIS,  the  surveillances  were  generalized  and  placed  into  one  of  the 
following  categories: 

Category  1:  On-line  surveillances  which  will  be  performed  on-line  in  IRIS; 

Category  2:  Candidate  surveillances  for  design  resolution  to  create  an  on-line  performance 
mode  in  IRIS; 

Category  3:  Surveillances  requiring  further  analysis  to  determine  performance  mode  in  IRIS; 
and. 

Category  4:  Off-line  surveillances  likely  to  have  performance  interval  extended  to  at  least 
eight  years  in  IRIS. 

The  design  methodology  was  developed  to  address  those  surveillances  in  Category  2. 

The  operating  PWR  investigation  addressed  a  48  month  operating  cycle,  but  the  IRIS  op¬ 
erating  cycle  length  goal  is  eight  years.  Therefore,  the  54  surveillances  resolved  to  Category  2 
represent  a  minimum  number  of  potential  IRIS  operating  cycle  length  barriers.  It  is  likely  that 
additional  unidentified  barriers  exist  which  were  already  compatible  with  the  48  month  operating 
PWR  cycle  length  (i.e.,  performance  periodicities  already  greater  than  48  months)  but  may  be  a 
barrier  to  an  eight  year  operating  cycle.  However,  this  thesis  did  not  investigate  surveillances  with 
a  periodicity  greater  than  48  months.  But,  since  the  54  known  barriers  cover  a  broad  spectrum  of 
systems  and  components  they  were  considered  representative  of  the  design  challenges  likely  to 
be  presented  by  the  unidentified  barriers. 

'Moore  Jr.,  Thomas  Joseph,  "A  Surveillance  Strategy  for  a  Four  Year  Operating  Cycle  in  Commercial  Pressurized 
Water  Reactors,”  Massachusetts  Institute  of  Technology  Department  of  Nuclear  Engineering,  Nuclear  Engineer's  The¬ 
sis,  May  1996. 
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The  design  methodology  developed  is  a  four-step  process.  The  first  step  is  the  synthesis  of 
the  general  requirements  that  the  component  must  satisfy.  The  second  step  is  the  synthesis  of  the 
design  objectives  with  the  design  requirements.  The  third  step  is  to  bound  the  solution  space  by 
application  of  suitable  and  relevant  constraints.  The  final  step  is  to  develop  design  alternatives 
which  meet  the  specifications  of  the  synthesized  design  requirements,  objectives,  and  constraints. 
Like  any  design  process,  the  methodology  flowchart  is  iterative  in  nature. 

12.1.2  Methodology  Application 

The  methodology  was  applied  to  the  identified  (Category  2)  operating  cycle  length  barriers. 
Many  of  the  barriers  were  considered  (based  on  discussions  with  the  IRIS  design  team)  to  be 
readily  solved  by  design,  and  so  a  detailed  investigation  into  these  barriers  was  not  conducted. 
However,  several  IRIS  operating  cycle  length  barriers  emerged  which  required  further  investiga¬ 
tion: 

•  Primary  relief  valve  testing, 

•  Steam  generator  eddy  current  inspection, 

•  Condenser  waterbox  maintenance, 

•  Main  turbine  throttle  control  maintenance, 

•  Safety  system  testing, 

•  Reduce  power  window  items,  and 

•  Reactivity  control  system  testing. 

Detailed  design  of  the  IRIS  core  has  not  been  completed,  and  so  reactivity  control  system 
testing  could  not  be  addressed  in  this  thesis.  The  resolution  methodology  was  applied  to  the 
remaining  barriers  and  feasible  (as  assessed  by  the  IRIS  design  team)  design  alternatives  were 
proposed  which  enable  achievement  of  the  eight  year  IRIS  operating  cycle  length  goal. 
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12.1.3  Resolution  Methodology  Limitations 


The  resolution  methodology  developed  and  applied  in  this  thesis  is  not  intended  to  eliminate 
the  need  for  creative  thought  in  the  design  process.  This  point  cannot  be  emphasized  enough, 
since  it  is  the  creative  element  that  allows  any  design  to  be  a  significant  improvement  over  the 
current  standard.  Although  the  results  presented  in  this  thesis  for  overcoming  operating  cycle 
length  barriers  are  the  produce  of  a  structured  methodology,  they  cannot  be  reproduced  without 
including  the  creative  design  element.  What  can  be  reproduced,  however,  is  the  synthesis  of  rel¬ 
evant  factors  into  a  limited  set  of  governing  constraints  which  guide  that  creative  process  toward 
feasible  solutions  which  meet  the  specified  requirements. 

12.2  Future  Work 

This  thesis  is  the  first  attempt  at  developing  a  structured  methodology  to  address  maintenance- 
related  barriers  to  an  extended  operating  cycle.  As  with  any  methodology,  refinement  and  im¬ 
provement  to  the  methodology  can  be  made  by  identifying  limitations  in  it's  applicability.  Al¬ 
though  feasible  solutions  were  generated  which  will  assist  the  IRIS  design  team  in  achieving  the 
target  operating  cycle  length  goal  of  eight  years,  there  is  a  significant  amount  of  future  work  that 
must  be  completed  to  improve  the  utility  of  this  methodology  as  discussed  below. 

Chapter  2,  'Design  Methodology  Framework,'  discussed  the  methodology  inputs  necessary  to 
develop  feasible  design  solution  alternatives.  These  inputs  were  developed  with  the  prior  knowl¬ 
edge  of  the  barriers  requiring  design  resolution.  Additional  investigation  into  the  creative  design 
process  needs  to  be  conducted  to  ensure  that  all  relevant  factors  have  been  adequately  captured.  If 
additional  factors  exist,  then  the  methodology  of  Chapter  5,  'Eliminating  the  Maintenance-Related 
Barriers,'  needs  to  be  updated  to  include  them. 

Chapter  3,  'Operating  Pressurized  Water  Reactor  Surveillance  Program,'  presented  the  results 
of  an  investigation  which  considered  only  those  surveillances  which  have  periodicities  less  than  48 
months.  The  identified  barriers  from  the  candidate  operating  PWR  investigation  were  considered 
to  be  representative  of  the  types  of  barriers  likely  to  emerge  from  the  unexamined  (greater  than  or 
equal  to  48  month  timeframe)  surveillances.  Further  examination  of  this  timeframe  is  required  to 
validate  the  assumption  that  the  spectrum  of  potential  barriers  has  been  bounded. 
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Chapters  6  through  11  presented  design  solution  alternatives  to  identified  IRIS  operating  cycle 
length  barriers.  As  the  IRIS  design  matures,  these  solutions  need  to  be  continuously  evaluated 
against  the  IRIS  design  requirements,  objectives,  and  constraints  to  ensure  that  the  proposed  so¬ 
lutions  remain  feasible. 

The  resolution  methodology  is  structured  to  generate  design  solution  alternatives  which  en¬ 
able  performing  all  maintenance  on-line  at  full  power.  Some  barriers  have  been  identified  which 
either  require  a  significant  research  and  development  expenditure  or  must  be  performed  during 
a  reduced  power  window.  It  would  be  useful  to  examine  the  economic  dependence  between  lost 
revenue  in  reduced  power  windows  and  capital  expenditure  to  eliminate  those  windows  to  de¬ 
velop  a  more  balanced  (economically  driven)  design  strategy. 

Finally,  the  operating  cycle  length  barriers  considered  in  this  thesis  were  well  defined  and  a 
large  amoimt  of  supporting  data  was  available  (since  these  barriers  were  not  IRIS  unique)  to  assist 
in  resolution.  As  the  IRIS  design  matures,  IRIS  vmique  operating  cycle  length  barriers  not  faced 
by  currently  operating  plants  will  certainly  emerge.  Application  of  the  resolution  methodology  to 
these  barriers  will  challenge  the  fundamental  structure  of  the  methodology  more  thoroughly  than 
has  been  done  in  this  thesis. 
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Appendix  A 


Identified  IRIS  Maintenance  Barriers 


This  appendix  summarizes  the  maintenance-related  barriers  described  in  Chapter  3,  'Operat¬ 
ing  Pressurized  Water  Reactor  Surveillance  Program/  Table  A.l  addresses  the  barriers  to  a  four 
year  operating  cycle.  Table  A.l  addresses  the  reduced  power  window  items,  and  Table  A.3  ad¬ 
dresses  the  barriers  to  an  eight  year  operating  cycle. 
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Table  A.l:  Identified  Maintenance  Barriers  to  Four- Year  Op¬ 
erating  Cycle 


Description 


Distussion 


Basis 


Installation  of  ASME  Class  1 
relief  valves  (including  pres- 
surizer  relief  valves  and  steam 
generator/main  steam  safety 
valves). 


Periodic  testing  of  ASME 
Class  1  relief  valves  (including 
pressurizer  relief  valves  and 
steam  generator/main  steam 
safety  valves). 


The  ASME  Boiler  &  Pressure 
Vessel  Code  primarily  deals 
with  relief  valve  construction, 
with  limited  discussion  of  in¬ 
stallation  requirements.  Within 
the  Code,  installation  of  an 
inlet  isolation  valve  is  per¬ 
mitted  under  certain  (inade¬ 
quately  specified)  conditions. 
IRIS  requires  a  relief  valve  in¬ 
let  isolation  valve  to  conduct  in 
situ  (but  off-service)  valve  test¬ 
ing. 

All  valves  of  each  type  and 
manufacture  shall  be  tested 
within  each  subsequent^  5  year 
period  with  a  minimum  of  20% 
of  the  valves  tested  within  any 
24  months.  This  20%  shall  be 
previously  xmtested  valves,  if 
they  exist. 


ASME  Boiler  &  Pressure  Ves¬ 
sel  Code,  Section  HI,  'Nuclear 
Power  Plant  Components,'  Ar¬ 
ticle  NB-7000,  'Overpressure 
Protection.' 


'The  Operation  and  Main¬ 
tenance  of  Nuclear  Power 
Plants,'  ASME/ANSI  OM- 
1989^,  Part  1,  'Requirements 
for  Inservice  Performance 
Testing  of  Nuclear  Power 
Plant  Pressure  Relief  Devices,' 
§1.3.3,  'Test  Frequency,  Class  1 
Pressure  Relief  Devices.' 


Table  A.l  continued  on  next  page 


’During  the  initial  5  year  period,  no  testing  is  required  during  the  first  12  months.  Testing  shall  be  performed  on 
a  minimum  25%  of  the  valves  of  each  type  and  manufacture  during  each  following  12  month  interval  such  that  at  the 
end  of  24  months  of  operation  25%  have  been  tested,  50%  in  36  months,  75%  in  48  months,  and  100%  in  60  months. 
Additionally,  during  any  running  24  month  period  a  minimum  of  20%  of  the  valves  (previously  untested,  if  they  exist) 
shall  be  tested. 

^Subsequent  updates  to  'The  Operations  and  Maintenance  of  Nuclear  Power  Plants'  have  occured  but  the  1989 
Edition  is  referenced  in  10  CFR  §50.55a(b). 


Table  A.  1  continued  from  previous  page 

Description 

...  Discussion 

Basis 

In-Service  testing  of  safety  re¬ 
lated  pumps  and  valves. 

All  safety  related  pumps  and 
valves  are  required  to  be  tested 
for  operability  on  a  quarterly 
basis.  Under  certain  circum¬ 
stances,  tests  which  cannot  be 
conducted  at  power  can  be  des¬ 
ignated  as  either  cold  shutdown 
tests  or  refueling  tests  and  be 
deferred  to  the  next  outage. 
Neither  require  prior  NRC  ap¬ 
proval  but  they  must  be  justi¬ 
fied,  augmented  by  risk-based 
arguments,  and  are  auditable. 

ASME  Boiler  &  Pressure  Vessel 

Code,  Section  XI,  'Rules  for  In- 
Service  Inspection  of  Nuclear 
Power  Plant  Components.' 

Periodic  testing  of  motor  oper¬ 
ated  valves  (MOVs)  in  safety 
related  systems. 

NRC  requires  all  MOVs  in 
safety  related  systems  to  be  di¬ 
agnostically  tested  and,  where 
practical,  tested  to  their  design 
basis  condition.  Testing  inter¬ 
val  is  determined  by  combin¬ 
ing  the  risk  significance  and 
failure  rate. 

ASME  Boiler  &  Pressure  Ves¬ 
sel  Code,  Section  XI,  'Rules 
for  In-Service  Inspection  of 
Nuclear  Power  Plant  Compo¬ 
nents'  supplemented  by  NRC 
Generic  Letter  96-05,  'Periodic 
Verification  of  Design-Basis 
Capability  of  Safety-Related 
Motor-Operated  Valves,' 

issued  September  18, 1996. 

Engineered  safety  feature  ac¬ 
tuation  tests  (integrated  tests 
which  involve  the  complete 
safety  signal  path  from  sensor 
to  system  actuation). 

These  tests  are  currently  per¬ 
formed  each  outage  and  are 
typically  segregated  into  three 
tests:  engineered  safeguards 
actuation,  containment  isola¬ 
tion,  and  core  cooling. 

Numerous  NRC  and  ASME 
regulations  apply. 

Table  AA  continued  on  next  page 
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Table  A. 1  continued  from  previous 

page 

>:  Desciiption: 

Discussion 

■Basis.'-'i  .  . 

Steam  generator  eddy  current 
testing. 

Steam  generator  eddy  current 
testing  is  currently  performed 
shutdown  at  18-24  month 
intervals.  NRC  inspection 

guidelines  for  steam  genera¬ 
tors  allows  for  periods  between 
steam  generator  eddy  current 
testing  of  up  to  40  months, 
after  two  previous  successful 
inspections  at  shorter  intervals. 

Numerous  NRC,  ASME,  and 
industry  regulations  and  rec¬ 
ommendations  apply.  NRC  let¬ 
ter  SECY-00-0078,  'Status  and 
Plans  for  Revising  the  Steam 
Generator  Tube  Integrety  Reg¬ 
ulatory  Framework,'  dtd  30 
March,  2000,  indicates  the  in¬ 
tent  for  the  NRC  to  accept 
the  recommendations  and  in¬ 
spection  procedures  contained 
in  the  Nuclear  Energy  Insti¬ 
tute  (NEI)  initiative,  NEI  97- 
06,  'Steam  Generator  Program 
Guidelines.' 

Periodic  testing  of  ASME 
Class  2  relief  valves  used  in 
non-primary  pressure  bound¬ 
ary  applications. 

All  valves  of  each  type  and 
manufacture  shall  be  tested 
within  each  subsequent^  10 
year  period  with  a  minimum  of 
20%  of  the  valves  tested  within 
any  48  months.  This  20%  shall 
be  previously  untested  valves, 
if  they  exist. 

Investment  protection  based. 
Testing  is  governed  by  'The 
Operation  and  Maintenance 
of  Nuclear  Power  Plants,' 
ASME/ANSI  OM-1989^  Part 
1,  'Requirements  for  Inser¬ 
vice  Performance  Testing  of 
Nuclear  Power  Plant  Pressure 
Relief  Devices,'  §1.3.4,  'Test 
Frequency,  Classes  2  and  3 
Pressure  Relief  Devices.' 

Table  Ad  continued  on  next  page 

^During  the  initial  10  year  period,  no  testing  is  required  during  the  first  24  months.  Testing  shall  be  performed  on 
a  minimum  25%  of  the  valves  of  each  type  and  manufacture  during  each  following  24  month  interval  such  that  at  the 
end  of  48  months  of  operation  25%  have  been  tested,  50%  in  72  months,  75%  in  96  months,  and  100%  in  120  months. 
Additionally,  during  any  running  48  month  period  a  minimum  of  20%  of  the  valves  (previously  untested,  if  they  exist) 
shall  be  tested. 

"^Subsequent  updates  to  'The  Operations  and  Maintenance  of  Nuclear  Power  Plants'  have  occured  but  the  1989 
Edition  is  referenced  in  10  CFR  §50.55a(b). 
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Table  A.l  continued  from  previous  page 

Description 

Discussion 

.  .  Basis 

Condenser  waterbox  inspec¬ 
tion  and  cleaning. 

The  primary  degredation 
mechanism  of  the  heat  trasfer 
capability  of  the  condenser  is 
the  fouling  and  clogging  of 
the  condenser  inlet  tube  sheets 

and  tube  surfaces  from  either 
debris  or  marine  growth. 

Investment  protection  based 
to  maintain  plant  thermody¬ 
namic  efficiency.  Numerous 
orgaiuzations  (Occupational 
Safety  and  Health  Adminis¬ 
tration  (OSHA),  Employee's 
Union,  etc.)  address  persormel 
safety  issues. 

Control  rod  drop  and  position 
indication  testing 

Control  and  shutdown  rod 
drop  testing  is  currently  per¬ 
formed  following  refueling  to 
guarantee  that  the  control  rods 
have  an  unimpeded  path  to  the 
bottom  of  the  core  and  that 
maximum  drop  times  are  con¬ 
sistent  with  the  assumed  drop 
times  used  in  the  plant  safety 
analysis.  No  upper  limit  to 
testing  frequency  is  specified 
by  the  NRC,  primarily  since 
no  current  plant  operates  on 
a  long  fuel  cycle  where  fuel 
swelling  (leading  to  control  rod 
binding)  is  of  concern.  Posi¬ 
tion  indication  testing  is  cur¬ 
rently  deferred  since  chemi¬ 
cal  reactivity  control  is  used 
and  the  control  rods  are  fully 
withdrawn  for  the  duration  of 
the  operating  cycle  (no  position 
uncertainty). 

Numerous  NRC  regulations  in¬ 
cluding  'NRC  Improved  Stan¬ 
dard  Technical  Specifications.' 

Table  AJ  continued  on  next  page 

Table  A.  1  continued  from  previous 

page 

Description  ^  V 

,  Discussion 

Electrically  operated  safety 
component  circuit  breaker 
overcurrent  relay  checks 

Overcurrent  relay  checks  of 
electrically  operated  safety 
component  circuit  breakers 
(primarily  pumps)  is  per¬ 
formed  periodically  to  ensure 
that  a  bound  safety  component 
will  trip  off-line  not  be  sensed 
by  the  safeguards  systems  as 
being  in  operation. 

Main  turbine  lubricating  oil 
system  low-pressure  trip 
switch  calibration. 

Calibration  of  the  main  tur¬ 
bine  low  shaft  pump  discharge  ^ 
pressure  and  low  bearing  oil 
pressure  switches  require  the 
main  turbine  to  be  shutdown. 

Vendor  provided  investment 
protection. 

Main  turbine  electrohydraulic 
control  (EHC)  system  clean 
and  inspect. 

A  complete  EHC  system  clean 
and  inspect,  including  soft¬ 
ware  and  filter  replacement,  is 
required  at  less  than  four-year 
intervals  (typically  24  months). 
This  maintenance  requires  the 
main  turbine  to  be  shutdown. 

Vendor  provided  investment 
protection.  Can  be  performed 
on-line  if  a  non-zero  steam  de¬ 
mand  (i.e.,  from  a  steam  dump 
or  large  auxiliary  loading)  can 
be  provided. 

Table  A.2:  Identified  Maintenance  Barriers  Requiring  Re¬ 
duced  Power 


Description 

Discussion 

Basis 

Steam  and  feedwater  flow  me¬ 
ter  calibrations. 

Requires  the  applicable  steam 
generator  to  be  secured. 

Investment  protection. 

Feedwater  control  valve  indi¬ 
cation  and  stroke  check. 

Requires  the  applicable  steam 
generator  to  be  secured. 

Investment  protection. 

Feedwater  isolation  valve 

stroke  check. 

Requires  the  applicable  steam 
generator  to  be  secured. 

Investment  protection.  Regu¬ 
latory  based  if  feedwater  iso¬ 
lation  valve  closure  is  part  of 
safety  system  actuation. 

Hydraulically  operated  valve 
fluid  change.  (Main  steam 
isolation  valves  and  feedwater 
isolation  valves  are  typically 
hydraulically  operated.) 

Requires  the  applicable  steam 
generator  to  be  secured. 

Investment  protection. 

Main  feed  pump  governor  cal¬ 
ibration. 

Requires  steam  demand  to  be 
reduced  to  the  capacity  of  re¬ 
maining  main  feed  pump(s). 

Investment  protection. 

Main  steam  isolation  valve 

stroke  check. 

Does  not  require  complete 
stroke,  and  causes  only  a  small 
reduction  in  steam  flow.  Steam 
demand  typically  reduced 
sufficiently  to  prevent  over¬ 
steaming  remaining  generators 
if  valve  inadvertently  closes 
fully. 

Investment  protection. 

Table  A.2  continued  on  next  page 
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Table  A.2  continued  from  previous 

page 

Description 

Discussion 

Basis 

Component  cooling  water  sys¬ 
tem  pump  maintenance. 

Requires  total  system  heat  load 
to  be  reduced  to  the  capacity 
of  remaining  component  cool¬ 
ing  water  system  pump(s). 

Investment  protection. 

Heat  exchanger  inlet  traveling 
screen  clean  and  inspect. 

Requires  heat  exchanger  to  be 
secured.  Total  system  heat  load 
is  required  to  be  reduced  to  the 
capacity  of  the  remaining  heat 
exchanger(s). 

Investment  protection. 

Table  A.3;  Identified  Maintenance  Barriers  to  Eight-Year  Op¬ 
erating  Cycle® 


..  .Description  ; 

Basis 

Electrical  switchgear  clean 
and  inspect  including  motor- 
operated  valve  inspections  and 
cable  meggers,  starter  checks, 
breaker  inspections,  unique 
features  testing,  and  visual 
inspections. 

Encompasses  a  large  num¬ 
ber  (over  450)  of  vmspecified 
surveillances  with  periodicities 
between  48  and  96  months. 
Shutdown  may  be  required  to 
permit  accessibility  or  when 
entire  (vital)  switchboards 
must  be  secured. 

Investment  protection;  fire 
safety. 

Periodic  maintenance  of 

non-safety  system  manu¬ 
ally  operated  valves.  Scope 
is  t)rpically  disassemble- 

inspect-reassemble  followed 
by  functional  testing. 

Periodicity  established  by  ven¬ 
dor,  typically  between  48  and 
72  months.  May  require  shut¬ 
down  if  valve  cannot  be  iso¬ 
lated  from  system. 

Investment  protection. 

Reactor  coolant  system  and 
containment  integrated  leak 
rate  testing. 

Extent  and  frequency  based  on 
material  history. 

ASME  Boiler  &  Pressure  Vessel 

Code,  Section  XI,  'Rules  for  In- 
Service  Inspection  of  Nuclear 
Power  Plant  Components.' 

Main  turbine  trip  and  throttle 
valve  inspection. 

Major  valves  in  the  main  tur¬ 
bine  steam  supply  path  are  typ¬ 
ically  inspected  at  48-60  month 
intervals. 

Vendor  provided  investment 
protection. 

Fire  station  and  snubber  in¬ 
spections. 

Typically  performed  at  48- 
60  month  intervals.  Some 

stations  inside  containment  are 
not  accessible  at  power. 

Investment  protection;  fire 
safety. 

Table  A3  continued  on  next  page 

^Includes  all  known  barriers  identified  in  Table  A.l. 
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Table  A.3  continued  from  previous  page 

Description 

.  Discussion 

Basis 

Control  rod  drive  mechanism 
(CRDM)  motor-generator 

set  mechanical  and  electrical 

maintenance. 

Requires  motor-generator  set 
to  be  secured.  T)q)ically  per¬ 
formed  at  54  month  intervals. 

Investment  protection. 

Charging  pump  mechanical 
and  electrical  maintenance. 

Performed  at  48-72  month  in¬ 
tervals.  Requires  shutdown  if 
insufficient  charging  capacity 
is  available. 

Investment  protection  and  reg¬ 
ulatory  based. 

Main  turbine  generator  (gener¬ 
ator  end)  electrical  inspections. 
Includes  stator  visual  inspec¬ 
tion  and  megger,  and  exciter 
inspection  and  megger. 

Typically  performed  at 

54  month  intervals. 

Vendor  provided  investment 
protection. 

so  I  _ 
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